GitHub Advisoryadvisory · Maven

GHSA-442g-gcg6-mhm4 Play Framework Inadequate Encryption Strength vulnerability

HIGH Published 2022-05-24 Modified 2022-11-22 Official page ↗
Aliases
CVE-2019-17598
Ecosystem
Maven
Packages
com.typesafe.play:play-ws_2.12
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-326
Reviewed
2022-11-22

Affected packages

• Maven com.typesafe.play:play-ws_2.12: >= 2.5.0, < 2.6.24 → fixed in 2.6.24

Description

An issue was discovered in Lightbend Play Framework 2.5.x through 2.6.23. When configured to make requests using an authenticated HTTP proxy, play-ws may sometimes, typically under high load, when connecting to a target host using https, expose the proxy credentials to the target host.

Related

Alias · CVE (1)

  • CVE-2019-17598 An issue was discovered in Lightbend Play Framework 2.5.x through 2.6.23. vulnerability

Weakness · CWE (1)

  • CWE-326 Inadequate Encryption Strength weakness

References