Bug 2250160 (CVE-2023-34062)

Summary:	CVE-2023-34062 reactor-netty-http: directory traversal vulnerability
Product:	[Other] Security Response	Reporter:	Robb Gatica <rgatica>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	aileenc, asoldano, bbaranow, bmaxwell, brian.stansberry, ccranfor, cdewolf, chazlett, cmiranda, darran.lofthouse, dkreling, dosoudil, fjuma, fmariani, gmalinko, ivassile, iweiss, janstey, jpechane, jpoth, lgao, mosmerov, msochure, mstefank, msvehla, nwallace, owatkins, pcongius, pdelbell, peholase, pjindal, pmackay, rstancel, sdawley, smaestri, tcunning, tom.jenkinson, yfang
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	Reactor Netty 1.1.13, Reactor Netty 1.0.39	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in the Reactor Netty HTTP Server. If the server is configured to serve static resources, an attacker can use a specially crafted URL that may allow unauthorized access to privileged data on the server.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2250159

Description Robb Gatica 2023-11-16 19:26:52 UTC

In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, a malicious user can send a request using a specially crafted URL that can lead to a directory traversal attack.

Specifically, an application is vulnerable if Reactor Netty HTTP Server is configured to serve static resources.

https://spring.io/security/cve-2023-34062

Comment 1 Robb Gatica 2023-11-16 19:34:59 UTC

depcli -a reactor-netty-http      
eap-7/reactor-netty-http=new
eap-8/reactor-netty-http=new
eap-xp/reactor-netty-http=new
fuse-7/reactor-netty-http=new
rhint-camel-k-1/reactor-netty-http=new
rhint-camel-spring-boot-3/reactor-netty-http=new
rhint-camel-spring-boot-4/reactor-netty-http=new
rhint-debezium-2/reactor-netty-http=new
rhos_devspaces-3/devspaces-pluginregistry-rhel8-container=new