equinox-bundles

3 results · Feed

• High 7.5
  CVE-2021-28165 Public exploit EPSS 54%

  Jetty vulnerable to incorrect handling of invalid large TLS frame, exhausting CPU resources

  In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invalid TLS frame.

  The Eclipse Foundation Eclipse Jetty jetty9 org.eclipse.jetty:jetty-server Debian Ubuntu Maven
  Apr 1, 2021
• Medium 5.3
  CVE-2021-28164 Public exploit Scanner template EPSS 82%

  Authorization Before Parsing and Canonicalization in jetty

  In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF directory. For example a request to /context/%2e/WEB-INF/web.xml …

  The Eclipse Foundation Eclipse Jetty jetty9 org.eclipse.jetty:jetty-webapp Debian Ubuntu Maven
  Apr 1, 2021
• Low 2.7
  CVE-2021-28163

  Directory exposure in jetty

  In Eclipse Jetty 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to 11.0.1, if a user uses a webapps directory that is a symlink, the contents of the webapps directory is deployed as a static webapp, inadvertently serving the webapps themselves and…

  The Eclipse Foundation Eclipse Jetty jetty9 equinox-bundles Debian Ubuntu Maven
  Apr 1, 2021