CVE-2020-5404

2020-03-0318:15:12

Google

osv.dev

6.7 Medium

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

35.5%

JSON

The HttpClient from Reactor Netty, versions 0.9.x prior to 0.9.5, and versions 0.8.x prior to 0.8.16, may be used incorrectly, leading to a credentials leak during a redirect to a different domain. In order for this to happen, the HttpClient must have been explicitly configured to follow redirects.

CPENameOperatorVersion
reactor-nettyeq0.7.12.RELEASE
reactor-nettyeq1.0.7
reactor-nettyeq0.9.9.RELEASE
reactor-nettyeq0.8.6.RELEASE
reactor-nettyeq0.9.7.RELEASE
reactor-nettyeq0.9.0.M3
reactor-nettyeq1.0.10
reactor-nettyeq0.9.3.RELEASE
reactor-nettyeq1.0.21
reactor-nettyeq1.0.28

Name	Operator	Version
reactor-netty	eq	0.7.12.RELEASE
reactor-netty	eq	1.0.7
reactor-netty	eq	0.9.9.RELEASE
reactor-netty	eq	0.8.6.RELEASE
reactor-netty	eq	0.9.7.RELEASE
reactor-netty	eq	0.9.0.M3
reactor-netty	eq	1.0.10
reactor-netty	eq	0.9.3.RELEASE
reactor-netty	eq	1.0.21
reactor-netty	eq	1.0.28