GHSA-442g-gcg6-mhm4HighCVSS 7.5

Play Framework Inadequate Encryption Strength vulnerability

Published
May 24, 2022
Last Modified
February 2, 2023

🔗 CVE IDs covered (1)

CVE-2019-17598 →

📋 Description

An issue was discovered in Lightbend Play Framework 2.5.x through 2.6.23. When configured to make requests using an authenticated HTTP proxy, play-ws may sometimes, typically under high load, when connecting to a target host using https, expose the proxy credentials to the target host.

🎯 Affected products1

  • maven/com.typesafe.play:play-ws_2.12:>= 2.5.0, < 2.6.24

🔗 References (4)