Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
29 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
9.4.11.v201806059.3.24.v20180605· Vendor fix available
Issue
In Eclipse Jetty Server, all 9.x versions, on webapps deployed using default Error Handling, when an intentionally bad query arrives that doesn't match a dynamic url-pattern, and is eventually handled by the DefaultServlet's static file serving, the bad characters can trigger a java.nio.file.InvalidPathException which includes the full path to the base resource directory that the DefaultServlet and/or webapp is using. If this InvalidPathException is then handled by the default Error Handler, the InvalidPathException message is included in the error response, revealing the full server path to the requesting system.
Recommended action: Upgrade to 9.4.11.v20180605 or 9.3.24.v20180605 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
9.4.6.v201705319.3.20.v201705319.2.22.v20170606· Vendor fix available
Issue
Jetty through 9.4.x contains a timing channel attack in util/security/Password.java, which allows attackers to obtain access by observing elapsed times before rejection of incorrect passwords.
Recommended action: Upgrade to 9.4.6.v20170531, 9.3.20.v20170531 or 9.2.22.v20170606 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
9.2.25.v201806069.3.24.v20180605· Vendor fix available
Issue
In Eclipse Jetty, versions 9.2.x and older, 9.3.x, transfer-encoding chunks are handled poorly. The chunk length parsing was vulnerable to an integer overflow. Thus a large chunk size could be interpreted as a smaller chunk size and content sent as chunk body could be interpreted as a pipelined request. If Jetty was deployed behind an intermediary that imposed some authorization and that intermediary allowed arbitrarily large chunks to be passed on unchanged, then this flaw could be used to bypass the authorization imposed by the intermediary as the fake pipelined request would not be interpreted by the intermediary as a request.
Recommended action: Upgrade to 9.3.24.v20180605 or 9.2.25.v20180606 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In Eclipse Jetty versions 9.4.0 through 9.4.8, when using the optional Jetty provided FileSessionDataStore for persistent storage of HttpSession details, it is possible for a malicious user to access/hijack other HttpSessions and even delete unmatched HttpSessions present in the FileSystem's storage for the FileSessionDataStore.
Recommended action: Upgrade to 9.4.11.v20180605 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.