[MAVEN:GHSA-7W4X-4H67-PGMV] Invalid HTTP requests in Reactor Netty HTTP Server may reveal access tokens

Severity Moderate

Affected Packages 1

Fixed Packages 1

CVEs 1

Reactor Netty HTTP Server, in versions 1.0.11 - 1.0.23, may request log headers in some cases of invalid HTTP requests. The logged headers may reveal valid access tokens to those with access to server logs. This may affect only invalid HTTP requests where logging at WARN level is enabled.

Package	Affected Version
pkg:maven/io.projectreactor.netty/reactor-netty-http	>= 1.0.11, < 1.0.24

Package	Fixed Version
pkg:maven/io.projectreactor.netty/reactor-netty-http	= 1.0.24

ID: MAVEN:GHSA-7W4X-4H67-PGMV
Severity: moderate
URL: https://github.com/advisories/GHSA-7w4x-4h67-pgmv
Published: 2022-10-20T12:00:17
(23 months ago)
Modified: 2023-02-03T05:00:51
(19 months ago)
Rights: Maven Security Team

Source	# ID	Name	URL
			https://nvd.nist.gov/vuln/detail/CVE-2022-31684
			https://tanzu.vmware.com/security/cve-2022-31684
			https://github.com/advisories/GHSA-7w4x-4h67-pgmv

Type	Package URL	Namespace	Name / Product	Version	Distribution / Platform	Arch	Patch / Fix
Affected	pkg:maven/io.projectreactor.netty/reactor-netty-http	io.projectreactor.netty	reactor-netty-http	>= 1.0.11 < 1.0.24
Fixed	pkg:maven/io.projectreactor.netty/reactor-netty-http	io.projectreactor.netty	reactor-netty-http	= 1.0.24

# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	Exploits	PoC	Pubblication Date	Modification Date
# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	PoC	Pubblication Date	Modification Date