CVE-2018-12543

In Eclipse Mosquitto versions 1.5 to 1.5.2 inclusive, if a message is published to Mosquitto that has a topic starting with $, but that is not $SYS, e.g. $test/test, then an assert is triggered that should otherwise not be reachable and Mosquitto will exit...

CVE-2018-12543

In Eclipse Mosquitto versions 1.5 to 1.5.2 inclusive, if a message is published to Mosquitto that has a topic starting with $, but that is not $SYS, e.g. $test/test, then an assert is triggered that should otherwise not be reachable and Mosquitto will exit...

CVE-2018-12543

CVE-2018-12543 affects Eclipse Mosquitto versions 1.5 through 1.5.2. When a message is published with a topic starting with ‘$’ but not ‘$SYS’ (e.g., ‘$test/test’), an assertion is triggered and Mosquitto exits. The issue is triggered during processing of such topics and is resolved in the 1.5.3 ...

CVE-2018-12543

In Eclipse Mosquitto versions 1.5 to 1.5.2 inclusive, if a message is published to Mosquitto that has a topic starting with $, but that is not $SYS, e.g. $test/test, then an assert is triggered that should otherwise not be reachable and Mosquitto will exit...

Jetty vulnerable to exposure of sensitive information to unauthenticated remote users

The exception handling code in Eclipse Jetty prior to 9.2.9.v20150224 allows remote attackers to obtain sensitive information from process memory via illegal characters in an HTTP header, aka JetLeak...

Security Bulletin: A vulnerability in IBM Java SDK affects IBM Spectrum Scale

Summary There is a vulnerability in IBM SDK Java Technology Edition, Version 8 used by IBM Spectrum Scale. This issue was disclosed as part of the IBM Java SDK updates in Jul 2018. Vulnerability Details CVEID: CVE-2018-12539 DESCRIPTION: Eclipse OpenJ9 could allow a local attacker to gain elevate...

Security Bulletin: Multiple Vulnerabilities in IBM Java SDK affect IBM Integration Designer

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 7, that affect IBM Integration Designer for IBM Business Process Manager BPM. Integration Designer has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2018-1656 DESCRIPTION: The IBM Java Runti...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect Rational Directory Server (Tivoli) & Rational Directory Administrator

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 7 and Version 8 used by Rational Directory Server Tivoli and Rational Directory Administrator. These issues were disclosed as part of the IBM Java SDK updates in July 2018. Upgrade the JRE in order to resolve the...

Moderate severity vulnerability that affects io.vertx:vertx-core

In Eclipse Vert.x version 3.0 to 3.5.1, the HttpServer response headers and HttpClient request headers do not filter carriage return and line feed characters from the header value. This allow unfiltered values to inject a new header in the client request or server response...

Eclipse RDF4j vulnerable to XML External Entity

Eclipse RDF4j version 2.4.0 Milestone 2 contains a XML External Entity XXE vulnerability in RDF4j XML parser parsing RDF files that can result in the disclosure of confidential data, denial of service, server side request forgery, port scanning. This attack appear to be exploitable via Specially...

GHSA-6XQ8-PVG4-3MF3 Eclipse RDF4j vulnerable to XML External Entity

Eclipse RDF4j version 2.4.0 Milestone 2 contains a XML External Entity XXE vulnerability in RDF4j XML parser parsing RDF files that can result in the disclosure of confidential data, denial of service, server side request forgery, port scanning. This attack appear to be exploitable via Specially...

GHSA-6X9X-8QW9-9PP6 Jetty vulnerable to authorization bypass due to inconsistent HTTP request handling (HTTP Request Smuggling)

Eclipse Jetty Server versions 9.2.x and older, 9.3.x all non HTTP/1.x configurations, and 9.4.x all HTTP/1.x configurations, are vulnerable to HTTP Request Smuggling when presented with two content-lengths headers, allowing authorization bypass. When presented with a content-length and a chunked...

GHSA-872G-2H8H-362Q Jetty contains an alias issue that could allow unauthenticated remote code execution due to specially crafted request

The path normalization mechanism in PathResource class in Eclipse Jetty 9.3.x before 9.3.9 on Windows allows remote attackers to bypass protected resource restrictions and other security constraints via a URL with certain escaped characters, related to backslashes...

Jetty contains an alias issue that could allow unauthenticated remote code execution due to specially crafted request

The path normalization mechanism in PathResource class in Eclipse Jetty 9.3.x before 9.3.9 on Windows allows remote attackers to bypass protected resource restrictions and other security constraints via a URL with certain escaped characters, related to backslashes...

GHSA-9RGV-H7X4-QW8G Eclipse Jetty Server generates error message containing sensitive information

In Eclipse Jetty Server, all 9.x versions, on webapps deployed using default Error Handling, when an intentionally bad query arrives that doesn't match a dynamic url-pattern, and is eventually handled by the DefaultServlet's static file serving, the bad characters can trigger a...

Eclipse Jetty Server generates error message containing sensitive information

In Eclipse Jetty Server, all 9.x versions, on webapps deployed using default Error Handling, when an intentionally bad query arrives that doesn't match a dynamic url-pattern, and is eventually handled by the DefaultServlet's static file serving, the bad characters can trigger a...

GHSA-VGG8-72F2-QM23 Critical severity vulnerability that affects org.eclipse.jetty:jetty-server

In Eclipse Jetty, versions 9.2.x and older, 9.3.x, transfer-encoding chunks are handled poorly. The chunk length parsing was vulnerable to an integer overflow. Thus a large chunk size could be interpreted as a smaller chunk size and content sent as chunk body could be interpreted as a pipelined...

Critical severity vulnerability that affects org.eclipse.jetty:jetty-server

In Eclipse Jetty, versions 9.2.x and older, 9.3.x, transfer-encoding chunks are handled poorly. The chunk length parsing was vulnerable to an integer overflow. Thus a large chunk size could be interpreted as a smaller chunk size and content sent as chunk body could be interpreted as a pipelined...

Security Bulletin: Security Vulnerabilities in IBM® Java SDK affect Rational Method Composer July 2018 CPU

Summary There are multiple vulnerabilities in IBM Java Development kit, Version 7 which is used by IBM Rational Method Composer RMC. These issues were disclosed as part of the IBM Java SDK updates in July 2018. Vulnerability Details CVEID: CVE-2018-1656 DESCRIPTION: The IBM Java Runtime...

Moderate: Red Hat Security Advisory: Red Hat OpenShift Application Runtimes security and bug fix update

An update is now available for Red Hat OpenShift Application Runtimes. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...