Information disclosure in Reactor Netty - CVE-2022-31684
Published: October 20, 2022
Vulnerability identifier: #VU68520
CSH Severity: Medium
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-31684
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to tge affected applicaton may log request headers in some cases of invalid HTTP requests. A remote user can reveal valid access tokens.
Affected software
Reactor Netty
Red Hat Openshift Application Runtimes
IBM Disconnected Log Collector
Cloudera Data Platform Private Cloud Base for IBM
IBM Security Guardium
Red Hat Openshift Application Runtimes
IBM Disconnected Log Collector
Cloudera Data Platform Private Cloud Base for IBM
IBM Security Guardium
How to mitigate CVE-2022-31684
Install updates from vendor's website.
Reactor Netty - update to 1.0.24
Cloudera Data Platform Private Cloud Base for IBM - addressed in versions 7.1.7 SP3, 7.1.9 SP1
IBM Disconnected Log Collector - update to 1.8.3
Cloudera Data Platform Private Cloud Base for IBM - addressed in versions 7.1.7 SP3, 7.1.9 SP1
IBM Disconnected Log Collector - update to 1.8.3
External References
Related Security Bulletins
- Information disclosure in VMware Reactor Netty
- Multiple vulnerabilities in IBM Security Guardium
- Multiple vulnerabilities in Red Hat Openshift Application Runtimes
- Multiple vulnerabilities in IBM Disconnected Log Collector
- Multiple vulnerabilities in Cloudera Data Platform Private Cloud Base with IBM (CDP)