The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. When making any HTTP request, the automatically enabled and self-managed CookieStore (aka cookie jar) will silently replace explicitly defined Cookies with any that have the same name from the cookie jar. For services that operate with multiple users, this can result in one user's Cookie being used for another user's requests.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and     asynchronously process HTTP responses. When making any HTTP request, the automatically enabled and self-     managed CookieStore (aka cookie jar) will silently replace explicitly defined Cookies with any that have     the same name from the cookie jar. For services that operate with multiple users, this can result in one     user's Cookie being used for another user's requests. (CVE-2024-53990)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and
    asynchronously process HTTP responses. When making any HTTP request, the automatically enabled and self-
    managed CookieStore (aka cookie jar) will silently replace explicitly defined Cookies with any that have
    the same name from the cookie jar. For services that operate with multiple users, this can result in one
    user's Cookie being used for another user's requests. (CVE-2024-53990)

ID	Name	Product	Family	Severity
257821	Linux Distros Unpatched Vulnerability : CVE-2024-53990	Nessus	Misc.	critical
416925	SCA: security update for org.asynchttpclient:async-http-client (GHSA-mfj5-cf8g-g2fv)	Tenable Cloud Security	SCA Checks	critical
416925	SCA: security update for org.asynchttpclient:async-http-client (GHSA-mfj5-cf8g-g2fv)	Tenable Self-Hosted Container Security	SCA Checks	critical

Detections

Analytics

CVE-2024-53990

critical

Tenable Plugins

critical

critical

critical