jetty9 - security update

Fixed packages 1

Vulnerabilities 4

• Medium 5.3
  CVE-2023-26048 Public exploit

  OutOfMemoryError for large multipart without filename in Eclipse Jetty

  Jetty is a java based web server and servlet engine. In affected versions servlets with multipart support (e.g. annotated with `@MultipartConfig`) that call `HttpServletRequest.getParameter()` or `HttpServletRequest.getParts()` may cause `OutOfMemoryError` wh…

  Eclipse Foundation jetty.project cassandra-reaper jetty9 Debian Ubuntu Wolfi Maven
  Apr 18, 2023
• Medium 5.3
  CVE-2023-40167 Public exploit

  Jetty accepts "+" prefixed value in Content-Length

  Jetty is a Java based web server and servlet engine. Prior to versions 9.4.52, 10.0.16, 11.0.16, and 12.0.1, Jetty accepts the `+` character proceeding the content-length value in a HTTP/1 header field. This is more permissive than allowed by the RFC and othe…

  Eclipse Foundation jetty.project druid cassandra-reaper Debian Ubuntu Wolfi Maven
  Sep 15, 2023
• Low 3.5
  CVE-2023-36479

  Jetty vulnerable to errant command quoting in CGI Servlet

  Eclipse Jetty Canonical Repository is the canonical repository for the Jetty project. Users of the CgiServlet with a very specific command structure may have the wrong command executed. If a user sends a request to a org.eclipse.jetty.servlets.CGI Servlet for…

  Eclipse Foundation jetty.project cassandra-reaper jetty9 Debian Ubuntu Wolfi Maven
  Sep 15, 2023
• Low 2.4
  CVE-2023-26049 Public exploit

  Cookie parsing of quoted values can exfiltrate values from other cookies in Eclipse Jetty

  Jetty is a java based web server and servlet engine. Nonstandard cookie parsing in Jetty may allow an attacker to smuggle cookies within other cookies, or otherwise perform unintended behavior by tampering with the cookie parsing mechanism. If Jetty sees a co…

  Eclipse Foundation jetty.project cassandra-reaper jetty9 Debian Ubuntu Wolfi Maven
  Apr 18, 2023