[MAVEN:GHSA-GHGJ-3XQR-6JFM] Jetty vulnerable to exposure of sensitive information to unauthenticated remote users

Severity High

Affected Packages 1

Fixed Packages 1

CVEs 1

The exception handling code in Eclipse Jetty prior to 9.2.9.v20150224 allows remote attackers to obtain sensitive information from process memory via illegal characters in an HTTP header, aka JetLeak.

Package	Affected Version
pkg:maven/org.eclipse.jetty/jetty-server	<= 9.2.8.v20150217

Package	Fixed Version
pkg:maven/org.eclipse.jetty/jetty-server	= 9.2.9.v20150224

ID

MAVEN:GHSA-GHGJ-3XQR-6JFM

Severity

high

URL

https://github.com/advisories/GHSA-ghgj-3xqr-6jfm

Published

2018-11-09T17:50:00
(5 years ago)

Modified

2023-01-08T05:02:40
(20 months ago)

Rights

Maven Security Team

Other Advisories

FEDORA-2015-2673

Source	# ID	Name	URL
			https://nvd.nist.gov/vuln/detail/CVE-2015-2080
			https://blog.gdssecurity.com/labs/2015/2/25/jetleak-vulnerability-remote-leakage-of-shared-buffers-in-je.html
			https://github.com/advisories/GHSA-ghgj-3xqr-6jfm
			https://github.com/eclipse/jetty.project/blob/jetty-9.2.x/advisories/2015-02-24-httpparser-error-buffer-bleed.md
			https://security.netapp.com/advisory/ntap-20190307-0005/
			http://dev.eclipse.org/mhonarc/lists/jetty-announce/msg00074.html
			http://dev.eclipse.org/mhonarc/lists/jetty-announce/msg00075.html
			http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151804.html
			http://packetstormsecurity.com/files/130567/Jetty-9.2.8-Shared-Buffer-Leakage.html
			http://seclists.org/fulldisclosure/2015/Mar/12
			http://www.securityfocus.com/archive/1/534755/100/1600/threaded
			http://www.securityfocus.com/bid/72768
			http://www.securitytracker.com/id/1031800

Type	Package URL	Namespace	Name / Product	Version	Distribution / Platform	Arch	Patch / Fix
Affected	pkg:maven/org.eclipse.jetty/jetty-server	org.eclipse.jetty	jetty-server	<= 9.2.8.v20150217
Fixed	pkg:maven/org.eclipse.jetty/jetty-server	org.eclipse.jetty	jetty-server	= 9.2.9.v20150224

# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	Exploits	PoC	Pubblication Date	Modification Date
# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	PoC	Pubblication Date	Modification Date