org.eclipse.jetty.aggregate:jetty-all (8.1.0.rc1), org.eclipse.jetty.aggregate:jetty-all-server (8.1.0.rc1) +42 more potentially affected by CVE-2023-26049 via org.eclipse.jetty:jetty-server (8.1.0.rc1)

org.eclipse.jetty:jetty-server MAVEN version 8.1.0.rc1 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - org.eclipse.jetty.aggregate:jetty-all 8.1.0.rc1 - org.eclipse.jetty.aggregate:jetty-all-server...

io.github.qsy7.java.examples:cli-jersey-guice (0.3.3), io.github.qsy7.java.infrastructure.inject.modules.web.providers.jetty.modules:jaxrs (0.3.3) +91 more potentially affected by CVE-2023-26049 via org.eclipse.jetty:jetty-server (>=12.0.0.alpha0, <=12.0.0.alpha3)

org.eclipse.jetty:jetty-server MAVEN version =12.0.0.alpha0, =12.0.0.alpha0, =12.0.0.alpha0, =12.0.0.alpha0, =12.0.0.alpha0, =12.0.0.alpha0, =12.0.0.alpha0, =12.0.0.alpha0, =12.0.0.alpha0, =...

be.tomcools:dropwizard-websocket-jsr356-bundle (4.0.0-beta.1), ch.exense.rtm:rtm (3.0.0) +628 more potentially affected by CVE-2023-26049 via org.eclipse.jetty:jetty-server (>=11.0.0, <=11.0.13)

org.eclipse.jetty:jetty-server MAVEN version =11.0.0, =3.24.1, =3.24.1, =3.24.1, =3.24.1, =3.24.1, =3.24.1, =3.24.1, =3.24.1, =3.23.0, =3.20.0, =3.20.0, =3.20.0, =3.22.0, =3.25.5 and more Source cves: CVE-2023-26049 Source advisory: MEND:CVE-2023-26049...

ai.catboost:catboost-spark_3.1_2.12 (>=1.0.1, <=1.2.8), ai.catboost:catboost-spark_3.2_2.12 (>=1.0.6, <=1.2.10) +12065 more potentially affected by CVE-2023-26049 via org.eclipse.jetty:jetty-server (>=7.0.0.m0, <=9.4.50.v20221201)

org.eclipse.jetty:jetty-server MAVEN version =7.0.0.m0, =1.0.1, =1.0.6, =1.0.6, =1.1, =1.1.1, =1.2, =1.2, =1.2.3, =1.2.3, =0.1.7, =0.1.7, =v1.1.0-226-g847ecff2d8e26f249422247d7665fe15f07b1744, =v1.1.0-226-g847ecff2d8e26f249422247d7665fe15f07b1744,...

ai.konduit.serving:konduit-serving-common-tests (0.3.0), app.cash.backfila:client-misk (>=0.1.4-20221221.1702-8b7db03, <=2023.06.07.175826-9233876) +356 more potentially affected by CVE-2023-26048 via org.eclipse.jetty:jetty-server (>=10.0.0, <=10.0.13)

org.eclipse.jetty:jetty-server MAVEN version =10.0.0, =0.1.4-20221221.1702-8b7db03, =0.1.4-20221221.1702-8b7db03, =2023.06.07.114626-93b9d6f, =0.1.4-20221128.2102-bdd85b6, =0.1.4-20221128.2102-bdd85b6, =6.4.0, =6.4.0, =6.4.0, =6.4.0, =6.4.0, =6.4.0, =6.4.0, =6.4.0, =6.4.7 -...

be.tomcools:dropwizard-websocket-jsr356-bundle (4.0.0-beta.1), ch.exense.rtm:rtm (3.0.0) +628 more potentially affected by CVE-2023-26048 via org.eclipse.jetty:jetty-server (>=11.0.0, <=11.0.13)

org.eclipse.jetty:jetty-server MAVEN version =11.0.0, =3.24.1, =3.24.1, =3.24.1, =3.24.1, =3.24.1, =3.24.1, =3.24.1, =3.24.1, =3.23.0, =3.20.0, =3.20.0, =3.20.0, =3.22.0, =3.25.5 and more Source cves: CVE-2023-26048 Source advisory: MEND:CVE-2023-26048...

ai.catboost:catboost-spark_3.1_2.12 (>=1.0.1, <=1.2.8), ai.catboost:catboost-spark_3.2_2.12 (>=1.0.6, <=1.2.10) +12065 more potentially affected by CVE-2023-26048 via org.eclipse.jetty:jetty-server (>=7.0.0.m0, <=9.4.50.v20221201)

org.eclipse.jetty:jetty-server MAVEN version =7.0.0.m0, =1.0.1, =1.0.6, =1.0.6, =1.1, =1.1.1, =1.2, =1.2, =1.2.3, =1.2.3, =0.1.7, =0.1.7, =v1.1.0-226-g847ecff2d8e26f249422247d7665fe15f07b1744, =v1.1.0-226-g847ecff2d8e26f249422247d7665fe15f07b1744,...

Eclipse Jetty information leakage vulnerability

Eclipse Jetty is an open source, Java-based web server and Java Servlet container from the Eclipse Foundation. An information disclosure vulnerability exists in Eclipse Jetty that stems from non-standard cookie parsing that could allow an attacker to smuggle cookies in other cookies or perform...

http2-server: Invalid HTTP/2 requests cause DoS

A flaw was found in the Eclipse Jetty http2-server package. This flaw allows an attacker to cause a denial of service in the server via HTTP/2 requests...

K33548065: Eclipse Jetty vulnerability CVE-2018-12536

Security Advisory Description In Eclipse Jetty Server, all 9.x versions, on webapps deployed using default Error Handling, when an intentionally bad query arrives that doesn't match a dynamic url-pattern, and is eventually handled by the DefaultServlet's static file serving, the bad characters ca...

SUSE CVE-2017-7658

In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x all non HTTP/1.x configurations, and 9.4.x all HTTP/1.x configurations, when presented with two content-lengths headers, Jetty ignored the second. When presented with a content-length and a chunked encoding header, the content-length was...

SUSE CVE-2019-10247

In Eclipse Jetty version 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older, the server running on any OS and Jetty version combination will reveal the configured fully qualified directory base resource location on the output of the 404 error for not finding a Context that matches...

http2-server: Invalid HTTP/2 requests cause DoS

A flaw was found in the Eclipse Jetty http2-server package. This flaw allows an attacker to cause a denial of service in the server via HTTP/2 requests...

jetty-server: Improper release of ByteBuffers in SslConnections

A flaw was found in the Jetty-server package. This flaw allows an attacker to send invalid requests, causing a denial of service in the Jetty Server...

http2-server: Invalid HTTP/2 requests cause DoS

A flaw was found in the Eclipse Jetty http2-server package. This flaw allows an attacker to cause a denial of service in the server via HTTP/2 requests...

OESA-2022-2149 jetty security update

%global desc \ Jetty is a 100% Java HTTP Server and Servlet Container. This means that you\ do not need to configure and run a separate web server like Apache in order\ to use Java, servlets and JSPs to generate dynamic content. Jetty is a fully\ featured web server for static and dynamic content...

jetty: requests to the ConcatServlet and WelcomeFilter are able to access protected resources within the WEB-INF directory

For Eclipse Jetty versions = 9.4.40, = 10.0.2, = 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory. For example a request to /concat?/%2557EB-INF/web.xml can retrieve the web.xml file. This can reveal...

Security Bulletin: IBM Sterling Connect:Direct Browser User Interface is vulnerable to multiple vulnerabilities due to Jetty.

Summary Summary: There are multiple vulnerabilities in Jetty Server. Sterling Connect:Direct Browser User Interface has addressed the applicable CVEs. Vulnerability Details IBM X-Force ID: 230016 DESCRIPTION: Eclipse Jetty is vulnerable to a denial of service, caused by an error related to some o...

CVE-2022-2191

A flaw was found in the Jetty-server package. This flaw allows an attacker to send invalid requests, causing a denial of service in the Jetty Server...

CVE-2022-2048

In Eclipse Jetty HTTP/2 server implementation, when encountering an invalid HTTP/2 request, the error handling has a bug that can wind up not properly cleaning up the active connections and associated resources. This can lead to a Denial of Service scenario where there are no enough resources lef...