CVE-2022-31684: Infoleak
A flaw was found in the Reactor Netty HTTP Server, which may log request headers in some cases of invalid HTTP requests. This could allow an attacker to access privileged information when WARN level logging is enabled.
Other sources
Reactor Netty HTTP Server, in versions 1.0.11 - 1.0.23, may log request headers in some cases of invalid HTTP requests. The logged headers may reveal valid access tokens to those with access to server logs. This may affect only invalid HTTP requests where logging at WARN level is enabled.
Reactor Netty HTTP Server, in versions 1.0.11 - 1.0.23, may request log headers in some cases of invalid HTTP requests. The logged headers may reveal valid access tokens to those with access to server logs. This may affect only invalid HTTP requests where logging at WARN level is enabled.
— GitHub
Tanzu VMware Reactor Netty could allow a remote authenticated attacker to obtain sensitive information, caused by the log of request headers in some cases of invalid HTTP requests. By gaining access to the log file, an attacker could exploit this vulnerability to obtain valid access tokens information, and use this information to launch further attacks against the affected system.
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2022-31684?
The severity of CVE-2022-31684 is medium.
How does CVE-2022-31684 affect Tanzu VMware Reactor Netty?
CVE-2022-31684 affects Tanzu VMware Reactor Netty by allowing a remote authenticated attacker to obtain sensitive information.
How can an attacker exploit CVE-2022-31684?
An attacker can exploit CVE-2022-31684 by gaining access to the log file and obtaining valid access tokens information.
What is the affected software for CVE-2022-31684?
The affected software for CVE-2022-31684 includes Tanzu VMware Reactor Netty version up to and excluding 1.0.24, and IBM Disconnected Log Collector versions v1.0 to v1.8.2.
How can I fix CVE-2022-31684?
To fix CVE-2022-31684, update Tanzu VMware Reactor Netty to version 1.0.24 or apply the appropriate remedy from IBM for Disconnected Log Collector.