Threats tagged 'ghsa-m347-hm9w-wwv9'

A vulnerability in the hackney HTTP client library (versions 2.0.0 up to but not including 4.9.0) allows credentials such as basic_auth and cookies to be leaked during redirects. When follow_redirect is enabled, redirects from HTTPS to HTTP or to a different port on the same host resend sensitive Authorization and Cookie headers in cleartext or to unintended services. This can expose credentials to on-path attackers.