Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
3 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact DefaultHttpClient follows redirects and forwards Authorization, Cookie, and Proxy-Authorization headers to redirect targets across domain boundaries. The blocklist only filters Host/Connection/TE/CT/CL. Additionally, no maximum redirect count exists, enabling infinite loop DoS. Affected: DefaultHttpClient.java lines 231-245, 1591, 2071 Suggested fix: Strip sensitive headers on cross-domain redirects Patches It has been patched for versions: For Micronaut 5, versions equal or greater than 5.0.1 = For Micronaut 4, versions equal or greater than 4.10.24 = For Micronaut 3, versions equal or greater than 3.10.6 = Workarounds No References Micronaut 5 Patch: https://github.com/micronaut-projects/micronaut-core/commit/9770328999f490bdfbb9e25addd45bf73d4a173a Micronaut 4 Patch: https://github.com/micronaut-projects/micronaut-core/commit/70cab4b44fbf985faba2846091f2356b5bd70719 Micronaut 3 Patch:…
Recommended action: Upgrade to 5.0.1, 4.10.24 or 3.10.6 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The Netty-based Micronaut HTTP Client does not impose a limit on HTTP redirections, potentially allowing an infinite redirect loop that could lead to a denial-of-service attack. Patches The following versions are patched: - For Micronaut 5, versions equal or greater than 5.0.1 = - For Micronaut 4, versions equal or greater than 4.10.24 = - For Micronaut 3, versions equal or greater than 3.10.7 = Workarounds No Resources Micronaut 5 Patch: https://github.com/micronaut-projects/micronaut-core/commit/6e88a972718d6e1521c5b3bb7766451798dba4e3 Micronaut 4 Patch: https://github.com/micronaut-projects/micronaut-core/commit/f1dffffec8fb5e3b7e94ae907ce0be3831e499d4 Micronaut 3 Patch: https://github.com/micronaut-projects/micronaut-core/commit/c06a2715ca7f78321bc3ca05f41cca78cd351320
Recommended action: Upgrade to 5.0.1, 4.10.24 or 3.10.7 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Vulnerability Micronaut's HTTP client is vulnerable to "HTTP Request Header Injection" due to not validating request headers passed to the client. Example of vulnerable code: In the above case a query value received from a user is passed as a header value to the client. Since the client doesn't validate the header value the request headers and body have the potential to be manipulated. For example, a user that supplies the following payload, can force the client to make multiple attacker-controlled HTTP requests. Note that using @HeaderValue instead of @QueryValue is not vulnerable since Micronaut's HTTP server does validate the headers passed to the server, so the exploit can only be triggered by using user data that is not an HTTP header (query values, form data etc.). Impact The attacker is able to control the entirety of the HTTP body for their custom requests. As such, this vulnerability enables attackers to perform a variant of Server Side Request Forgery. Patches The problem…
Recommended action: Upgrade to 1.3.2 or 1.2.11 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.