Description (CNA)
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.1.0 until 3.0.14, the default ThreadSafeCookieStore does not retain whether a Set-Cookie response used a secure transport. It accepts Secure cookies received over plaintext and permits insecure cookies to overlay or delete existing Secure cookies with matching scope. An attacker controlling a plaintext same-site response can consequently plant, replace, or remove cookie state later sent to an HTTPS origin, enabling session fixation, CSRF-token replacement, or loss of security-relevant state. This issue is fixed in version 3.0.14.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| AsyncHttpClient / async-http-client | affected >= 2.1.0, <= 2.16.1; affected >= 3.0.0, < 3.0.14 |
CWE
CWE-384, CWE-693
References
- https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-p2jm-6hj6-9rjg
- https://github.com/AsyncHttpClient/async-http-client/commit/6ec7ee45034d154f502852a962d2891746fb82c1
- https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-3.0.14
ADP enrichment
No English description supplied.
No references supplied.