Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
3 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and/or bypass some security constraints. This is a variation of the vulnerability reported in CVE-2021-28164/GHSA-v7ff-8wcx-gmc5. Impact The default compliance mode allows requests with URIs that contain a %u002e segment to access protected resources within the WEB-INF directory. For example, a request to /%u002e/WEB-INF/web.xml can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application. Similarly, an encoded null character can prevent correct normalization so that /.%00/WEB-INF/web.xml cal also retrieve the web.xml file. Workarounds Some Jetty rewrite rules can be deployed to rewrite any request containing encoded dot segments or null characters in the raw request URI, to a known not found resource: Analysis Prior to 9.4.37, Jetty was protected from this style of attack by two lines of defense: + URIs were decoded…
Recommended action: Upgrade to 11.0.6, 10.0.6 or 9.4.43 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Release 9.4.37 introduced a more precise implementation of RFC3986 with regards to URI decoding, together with some new compliance modes to optionally allow support of some URI that may have ambiguous interpretation within the Servlet specified API methods behaviours. The default mode allowed % encoded . characters to be excluded for URI normalisation, which is correct by the RFC, but is not assumed by common Servlet implementations. The default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF directory. For example a request to /context/%2e/WEB-INF/web.xml can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application. Workarounds found by HttpCompliance mode RFC7230NOAMBIGUOUSURIS can be enabled by updating start.d/http.ini to include: jetty.http.compliance=RFC7230NOAMBIGUOUSURIS.
Recommended action: Upgrade to 9.4.39 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
11.0.0.beta310.0.0.beta39.4.33.v20201020· Vendor fix available
Issue
Impact On Unix like systems, the system's temporary directory is shared between all users on that system. A collocated user can observe the process of creating a temporary sub directory in the shared temporary directory and race to complete the creation of the temporary subdirectory. If the attacker wins the race then they will have read and write permission to the subdirectory used to unpack web applications, including their WEB-INF/lib jar files and JSP files. If any code is ever executed out of this temporary directory, this can lead to a local privilege escalation vulnerability. Additionally, any user code uses of WebAppContext::getTempDirectory) would similarly be vulnerable. Additionally, any user application code using the ServletContext attribute for the tempdir will also be impacted. See: https://javaee.github.io/javaee-spec/javadocs/javax/servlet/ServletContext.html#TEMPDIR For example: Example: The JSP library itself will use the container temp directory for compiling the…
Recommended action: Upgrade to 11.0.0.beta3, 10.0.0.beta3 or 9.4.33.v20201020 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.