Skip to content
OpenAdvisories
Medium · 5.3 CVE-2018-12536 EUVD-2018-0567GHSA-9rgv-h7x4-qw8g

Eclipse Jetty Server generates error message containing sensitive information

Published Jun 27, 2018 · Updated Aug 5, 2024 · Assigned by eclipse

Description

In Eclipse Jetty Server, all 9.x versions, on webapps deployed using default Error Handling, when an intentionally bad query arrives that doesn't match a dynamic url-pattern, and is eventually handled by the DefaultServlet's static file serving, the bad characters can trigger a java.nio.file.InvalidPathException which includes the full path to the base resource directory that the DefaultServlet and/or webapp is using. If this InvalidPathException is then handled by the default Error Handler, the InvalidPathException message is included in the error response, revealing the full server path to the requesting system.

Affected products

VendorProductAffectedFixed
The Eclipse Foundation Eclipse Jetty unspecified – ≤ 9.2.0, 9.3.0 – < unspecified, unspecified – < 9.3.24, 9.4.0 – < unspecified, unspecified – < 9.4.11 unspecified

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 jetty9 9.2.25-1 —
Debian 13 jetty9 9.2.25-1 —
Debian 12 jetty9 9.2.25-1 —
Debian 9 jetty9 9.2.30-0+deb9u1 DLA-2661-1
ReleasePackageFixed inAdvisory
Ubuntu 16.04 LTS jetty9 No fix yet —

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.eclipse.jetty:jetty-server >= 9.4.0, < 9.4.11.v20180605 9.4.11.v20180605 GHSA-9rgv-h7x4-qw8g
Maven org.eclipse.jetty:jetty-server >= 9.0.0, < 9.3.24.v20180605 9.3.24.v20180605 GHSA-9rgv-h7x4-qw8g

Advisories 1

References