Authorization Before Parsing and Canonicalization in jetty

🗓️ 06 Apr 2021 17:31:01Reported by GitHub Advisory DatabaseType

github🔗 github.com👁 173 Views

Authorization before parsing and canonicalization in Jetty. Update to release 9.4.37 implements precise RFC3986 with new compliance modes for ambiguous URI interpretation within Servlet methods

Reporter	Title	Published	Views	Family All 90
0day.today	Jetty 9.4.37.v20210219 - Information Disclosure Vulnerability	22 Oct 202100:00	–	zdt
IBM Security Bulletins	Security Bulletin: IBM MQ is vulnerable to multiple Eclipse Jetty issues	24 Jun 202216:32	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Eclipse Jetty affect IBM InfoSphere Information Server	17 May 202302:32	–	ibm
IBM Security Bulletins	Security Bulletin: An Eclipse Jetty vulnerability affects IBM Rational Functional Tester	29 Mar 202206:27	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Eclipse Jetty affect IBM Installation Manager and IBM Packaging Utility	24 Jun 202116:12	–	ibm
IBM Security Bulletins	Security Bulletin: IBM MaaS360 Mobile Enterprise Gateway uses Eclipse Jetty with multiple known vulnerabilities	6 Jun 202218:23	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cognos Analytics has addressed multiple vulnerabilities	29 Jun 202123:59	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in Rational Change 5.3.2 Fix Pack 04 and earlier versions.	11 Oct 202208:56	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Eclipse Jetty affect Rational Performance Tester (CVE-2021-28169, CVE-2021-34428, CVE-2021-28163, CVE-2021-28164, CVE-2021-34429, CVE-2021-28165)	29 Jul 202220:31	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Connect:Direct Web Services is vulnerable to multiple vulnerabilities due to Eclipse Jetty	1 Jun 202211:34	–	ibm

Vulners

Node

org.eclipse.jetty jetty-webappRange9.4.37–9.4.39maven

Source	Link
github	www.github.com/eclipse/jetty.project/security/advisories/GHSA-v7ff-8wcx-gmc5
nvd	www.nvd.nist.gov/vuln/detail/CVE-2021-28164
lists	www.lists.apache.org/thread.html/r780c3c210a05c5bf7b4671303f46afc3fe56758e92864e1a5f0590d0@%3Cjira.kafka.apache.org%3E
lists	www.lists.apache.org/thread.html/r5b3693da7ecb8a75c0e930b4ca26a5f97aa0207d9dae4aa8cc65fe6b@%3Cissues.ignite.apache.org%3E
lists	www.lists.apache.org/thread.html/rd7c8fb305a8637480dc943ba08424c8992dccad018cd1405eb2afe0e@%3Cdev.ignite.apache.org%3E
lists	www.lists.apache.org/thread.html/r0841b06b48324cfc81325de3c05a92e53f997185f9d71ff47734d961@%3Cissues.solr.apache.org%3E
lists	www.lists.apache.org/thread.html/r4a66bfbf62281e31bc1345ebecbfd96f35199eecd77bfe4e903e906f@%3Cissues.ignite.apache.org%3E
lists	www.lists.apache.org/thread.html/r4b1fef117bccc7f5fd4c45fd2cabc26838df823fe5ca94bc42a4fd46@%3Cissues.ignite.apache.org%3E
lists	www.lists.apache.org/thread.html/r6ac9e263129328c0db9940d72b4a6062e703c58918dd34bd22cdf8dd@%3Cissues.ignite.apache.org%3E
lists	www.lists.apache.org/thread.html/r111f1ce28b133a8090ca4f809a1bdf18a777426fc058dc3a16c39c66@%3Cissues.solr.apache.org%3E

01 Feb 2023 05:05Current

3.1Low risk

Vulners AI Score3.1

CVSS 25

CVSS 3.15.3

EPSS0.93485

jetty release 9.4.37 rfc3986 uri decoding compliance mode servlet ambiguous interpretation http.ini rfc7230_no_ambiguous_uris