Fixed packages 15
| Release | Package | Fixed in |
|---|---|---|
| Red Hat · Devtools 2021 devtools:2021 | rh-eclipse-jetty | 0:9.4.40-1.1.el7_9 |
| Red Hat · Devtools 2021 devtools:2021 | rh-eclipse-jetty-client | 0:9.4.40-1.1.el7_9 |
| Red Hat · Devtools 2021 devtools:2021 | rh-eclipse-jetty-continuation | 0:9.4.40-1.1.el7_9 |
| Red Hat · Devtools 2021 devtools:2021 | rh-eclipse-jetty-http | 0:9.4.40-1.1.el7_9 |
| Red Hat · Devtools 2021 devtools:2021 | rh-eclipse-jetty-io | 0:9.4.40-1.1.el7_9 |
| Red Hat · Devtools 2021 devtools:2021 | rh-eclipse-jetty-jaas | 0:9.4.40-1.1.el7_9 |
| Red Hat · Devtools 2021 devtools:2021 | rh-eclipse-jetty-javadoc | 0:9.4.40-1.1.el7_9 |
| Red Hat · Devtools 2021 devtools:2021 | rh-eclipse-jetty-jmx | 0:9.4.40-1.1.el7_9 |
| Red Hat · Devtools 2021 devtools:2021 | rh-eclipse-jetty-security | 0:9.4.40-1.1.el7_9 |
| Red Hat · Devtools 2021 devtools:2021 | rh-eclipse-jetty-server | 0:9.4.40-1.1.el7_9 |
| Red Hat · Devtools 2021 devtools:2021 | rh-eclipse-jetty-servlet | 0:9.4.40-1.1.el7_9 |
| Red Hat · Devtools 2021 devtools:2021 | rh-eclipse-jetty-util | 0:9.4.40-1.1.el7_9 |
| Red Hat · Devtools 2021 devtools:2021 | rh-eclipse-jetty-util-ajax | 0:9.4.40-1.1.el7_9 |
| Red Hat · Devtools 2021 devtools:2021 | rh-eclipse-jetty-webapp | 0:9.4.40-1.1.el7_9 |
| Red Hat · Devtools 2021 devtools:2021 | rh-eclipse-jetty-xml | 0:9.4.40-1.1.el7_9 |
Vulnerabilities 3
-
High 7.5
Jetty vulnerable to incorrect handling of invalid large TLS frame, exhausting CPU resources
In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invalid TLS frame.
-
Medium 5.3
Authorization Before Parsing and Canonicalization in jetty
In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF directory. For example a request to /context/%2e/WEB-INF/web.xml …
-
Low 2.7
Directory exposure in jetty
In Eclipse Jetty 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to 11.0.1, if a user uses a webapps directory that is a symlink, the contents of the webapps directory is deployed as a static webapp, inadvertently serving the webapps themselves and…
References
-
article
https://access.redhat.com/security/updates/classification/#moderate
-
article
https://access.redhat.com/documentation/en-us/red_hat_developer_tools/1/html/using_eclipse_4.19/
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1945710
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1945712
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1945714
-
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_1509.json
-
report
https://access.redhat.com/security/cve/CVE-2021-28163
-
advisory
https://www.cve.org/CVERecord?id=CVE-2021-28163
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2021-28163
-
article
https://github.com/eclipse/jetty.project/security/advisories/GHSA-j6qj-j888-vvgq
-
report
https://access.redhat.com/security/cve/CVE-2021-28164
-
advisory
https://www.cve.org/CVERecord?id=CVE-2021-28164
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2021-28164
-
article
https://github.com/eclipse/jetty.project/security/advisories/GHSA-v7ff-8wcx-gmc5
-
report
https://access.redhat.com/security/cve/CVE-2021-28165
-
advisory
https://www.cve.org/CVERecord?id=CVE-2021-28165
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2021-28165
-
article
https://github.com/eclipse/jetty.project/security/advisories/GHSA-26vr-8j45-3r4w