Security Bulletin: SPSS Collaboration and Deployment Services is affected by Eclipse Jetty Digest Authentication Bypass Vulnerability

Summary SPSS Collaboration and Deployment Services is affected by Eclipse Jetty Digest Authentication Bypass Vulnerability. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-10050 DESCRIPTION: In Eclipse Jetty, the Digest authentication server-side component...

SUSE SLED15: jetty-continuation / jetty-http / jetty-io / jetty-security / etc (SUSE-SU-2026:3631-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:3631-1 advisory. - CVE-2026-10050: ISO-8859-1 lossy encoding allows authentication bypass via character substitution bsc1272393. Tenable...

Security update for jetty-minimal

This update for jetty-minimal fixes the following issues: CVE-2026-10050: ISO-8859-1 lossy encoding allows authentication bypass via character substitution bsc1272393. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper...

CVE-2026-10050

In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes. This was done because the initial specification for HTTP did not specify explicitly a charset, and it was assumed to be ISO-8859-1 for historical reasons. If the password contains...

GHSA-2FVJ-HGJ9-J2GR Eclipse Jetty Digest Authentication: ISO-8859-1 lossy encoding allows authentication bypass via character substitution

Summary The DigestAuthentication.apply method in Jetty's HTTP client uses getBytesStandardCharsets.ISO88591 at three locations lines 171, 179, 196 to compute Digest auth response hashes. ISO-8859-1 silently replaces any character above U+00FF Chinese, Japanese, Cyrillic, Arabic, Emoji, etc. with...

SUSE-SU-2024:3844-1 Security update for 389-ds

This update for 389-ds fixes the following issues: - Persist extracted key path for ldapsslclientinit over repeat invocations bsc1230852 - Re-enable use of .dsrc basedn for dsidm commands bsc1231462 - Update to version 2.2.10git18.20ce9289: RFE: Use previously extracted key path Update dsidm to...