Security Bulletin: A vulnerability in Eclipse Jetty affects the IBM InfoSphere Information Server installers

Summary A vulnerability in Eclipse Jetty was addressed by IBM InfoSphere Information Server. Vulnerability Details CVEID: CVE-2017-9735 DESCRIPTION: Jetty could allow a remote attacker to obtain sensitive information, caused by a timing channel flaw in util/security/Password.java. By observing...

Eclipse Jetty CVE-2017-7656 Security Vulnerability

Description Eclipse Jetty is prone to a security vulnerability. An attacker can exploit this issue to conduct an HTTP request smuggling attack and perform unauthorized actions. This may lead to further attacks. Technologies Affected Eclipse Jetty 9.2.0 Eclipse Jetty 9.3.0 Eclipse Jetty 9.4.0 HP...

PT-2018-3159

Name of the Vulnerable Software and Affected Versions Eclipse Jetty Server versions 9.x Description The issue is related to the DefaultServlet's handling of intentionally bad queries that do not match a dynamic url-pattern. When such a query is handled by the DefaultServlet's static file serving,...

PT-2018-3781

Name of the Vulnerable Software and Affected Versions Eclipse Jetty Server versions 9.2.x and older Eclipse Jetty Server versions 9.3.x all non HTTP/1.x configurations Eclipse Jetty Server versions 9.4.x all HTTP/1.x configurations Description The issue is related to the implementation of the...

PT-2018-3158

Name of the Vulnerable Software and Affected Versions Eclipse Jetty versions 9.4.0 through 9.4.8 Description The issue is related to the use of the optional Jetty provided FileSessionDataStore for persistent storage of HttpSession details. A malicious user can access or hijack other HttpSessions...

Juniper Networks Releases Security Updates

Juniper Networks has released security updates to address vulnerabilities affecting multiple products. A remote attacker could exploit some of these vulnerabilities to take control of an affected system. NCCIC encourages users and administrators to review the following Juniper Security Advisories...

CVE-2016-4800

The path normalization mechanism in PathResource class in Eclipse Jetty 9.3.x before 9.3.9 on Windows allows remote attackers to bypass protected resource restrictions and other security constraints via a URL with certain escaped characters, related to backslashes...

CVE-2016-4800

The path normalization mechanism in PathResource class in Eclipse Jetty 9.3.x before 9.3.9 on Windows allows remote attackers to bypass protected resource restrictions and other security constraints via a URL with certain escaped characters, related to backslashes...

Design/Logic Flaw

The path normalization mechanism in PathResource class in Eclipse Jetty 9.3.x before 9.3.9 on Windows allows remote attackers to bypass protected resource restrictions and other security constraints via a URL with certain escaped characters, related to backslashes...

CVE-2016-4800

The path normalization mechanism in PathResource class in Eclipse Jetty 9.3.x before 9.3.9 on Windows allows remote attackers to bypass protected resource restrictions and other security constraints via a URL with certain escaped characters, related to backslashes...

CVE-2016-4800

The path normalization mechanism in PathResource class in Eclipse Jetty 9.3.x before 9.3.9 on Windows allows remote attackers to bypass protected resource restrictions and other security constraints via a URL with certain escaped characters, related to backslashes...

CVE-2016-4800: Improper Access Control

The path normalization mechanism in PathResource class in Eclipse Jetty 9.3.x before 9.3.9 on Windows allows remote attackers to bypass protected resource restrictions and other security constraints via a URL with certain escaped characters, related to backslashes...

Code injection

The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote attackers to obtain sensitive information from process memory via illegal characters in an HTTP header, aka JetLeak...

CVE-2015-2080

The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote attackers to obtain sensitive information from process memory via illegal characters in an HTTP header, aka JetLeak...

CVE-2015-2080

The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote attackers to obtain sensitive information from process memory via illegal characters in an HTTP header, aka JetLeak...

CVE-2015-2080

The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote attackers to obtain sensitive information from process memory via illegal characters in an HTTP header, aka JetLeak...

CVE-2015-2080

CVE-2015-2080 affects Eclipse Jetty; vulnerability in exception handling allows remote attackers to disclose sensitive memory contents via illegal characters in HTTP headers (JetLeak). Affected product: Jetty versions before 9.2.9.v20150224. Impact per sources: information disclosure; no integrit...

CVE-2015-2080

The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote attackers to obtain sensitive information from process memory via illegal characters in an HTTP header, aka JetLeak...

CVE-2015-2080: Exposure of Sensitive Information to an Unauthorized Actor

The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote attackers to obtain sensitive information from process memory via illegal characters in an HTTP header, aka JetLeak...

PT-2016-3596

Name of the Vulnerable Software and Affected Versions Eclipse Jetty versions prior to 9.2.9.v20150224 Description The exception handling code in Eclipse Jetty allows remote attackers to obtain sensitive information from process memory via illegal characters in an HTTP header. This issue is also...