Bug 2547730 (CVE-2026-107283)
| Summary: | CVE-2026-107283 org.asynchttpclient/async-http-client: async-http-client: Weakened Digest authentication via insecure client nonce generation | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | low | Docs Contact: | |
| Priority: | low | ||
| Version: | unspecified | CC: | gmalinko, janstey, pdelbell, rstepani |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in AsyncHttpClient. This vulnerability can weaken authentication security because the Realm.Builder component generates HTTP Digest client nonces—unique values used to protect against replay and precomputation attacks—using an insecure random number generator instead of a cryptographically secure source. A remote network attacker who observes authentication exchanges may infer the internal generator state, lowering the security of the exchange and potentially facilitating credential attacks.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
OSIDB Bzimport
2026-10-07 21:41:25 UTC
|