Threats tagged 'ghsa-7758-m63q-7vr5'

Apache bRPC versions through 1.17.0 contain an improper authentication vulnerability that allows remote unauthenticated attackers to bypass authentication on protected non-builtin HTTP endpoints. This occurs when ServerOptions.auth is enabled and builtin HTTP services are exposed on the public listener. An attacker can send a builtin HTTP request first on the same HTTP/1.1 keep-alive connection, causing the connection to be treated as authenticated for subsequent requests. The issue is fixed in version 1.18.0.