HTTP Header Trust Boundaries

Two Artifactory flaws poisoned metadata, not artifacts, and that was enough to break a shared cache

Oligo Security says a 32-bit cache key and a trusted .jfrog/ directory let low-privileged users serve other people a poisoned index. JFrog has patched both.