Most recent entries from all

bdu:2022-05510

certfr-2021-avi-951 — De multiples vulnérabilités ont été découvertes dans le noyau Linux de RedHat. Certaines d'entre elles permettent à un…

certfr-2021-avi-951

cnvd-2021-27374

EUVD-2026-25867

fkie_cve-2021-28164

In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF directory. For example a request to /context/%2e/WEB-INF/web.xml can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.

GHSA-v7ff-8wcx-gmc5 — Authorization Before Parsing and Canonicalization in jetty

Affected: Maven: org.eclipse.jetty:jetty-webapp

Release 9.4.37 introduced a more precise implementation of [RFC3986](https://tools.ietf.org/html/rfc3986#section-3.3) with regards to URI decoding, together with some new compliance modes to optionally allow support of some URI that may have ambiguous interpretation within the Servlet specified API methods behaviours. The default mode allowed % encoded . characters to be excluded for URI normalisation, which is correct by the RFC, but is not assumed by common Servlet implementations. The default compliance mode allows requests with URIs that contain `%2e` or `%2e%2e` segments to access protected resources within the `WEB-INF` directory. For example a request to `/context/%2e/WEB-INF/web.xml` can retrieve the `web.xml` file. This can reveal sensitive information regarding the implementation of a web application. Workarounds found by HttpCompliance mode RFC7230_NO_AMBIGUOUS_URIS can be enabled by updating `start.d/http.ini` to include: jetty.http.compliance=RFC7230_NO_AMBIGUOUS_URIS.

gsd-2021-28164

openSUSE-SU-2021:2005-1 — Security update for jetty-minimal

Security update for jetty-minimal

RHSA-2021:1509 — Red Hat Security Advisory: rh-eclipse-jetty security update

jetty: Symlink directory exposes webapp directory contents jetty: Ambiguous paths can access WEB-INF jetty: Resource exhaustion when receiving an invalid large TLS frame

SUSE-SU-2021:2005-1 — Security update for jetty-minimal

Security update for jetty-minimal

UBUNTU-CVE-2021-28164

Affected: Ubuntu:18.04:LTS: equinox-bundles, Ubuntu:20.04:LTS: equinox-bundles, Ubuntu:22.04:LTS: equinox-bundles

WID-SEC-W-2022-1365 — Eclipse Jetty: Mehrere Schwachstellen

Ein entfernter, authentisierter oder anonymer Angreifer kann mehrere Schwachstellen in Eclipse Jetty ausnutzen, um Informationen offenzulegen und einen Denial of Service Zustand auszulösen.