com.bolyartech.ezlambda:ezlambda-server (1.1.1), com.bolyartech.forge.server:forge-server-jetty (>=9.1.3, <=10.0.2) +75 more potentially affected by CVE-2021-28165 via org.eclipse.jetty:jetty-server (>=10.0.0, <=10.0.1)

org.eclipse.jetty:jetty-server MAVEN version =10.0.0, =9.1.3, =1.3.6, =4.2.0-beta.1, =0.0.31, =1.8.3, =6.0.0, =6.0.0, =6.0.1 and more Source cves: CVE-2021-28165 Source advisory: GHSA-26VR-8J45-3R4W...

com.bolyartech.ezlambda:ezlambda-server (1.1.1), com.bolyartech.forge.server:forge-server-jetty (>=9.1.3, <=10.0.2) +75 more potentially affected by CVE-2021-28165 via org.eclipse.jetty:jetty-server (>=10.0.0, <=10.0.1)

org.eclipse.jetty:jetty-server MAVEN version =10.0.0, =9.1.3, =1.3.6, =4.2.0-beta.1, =0.0.31, =1.8.3, =6.0.0, =6.0.0, =6.0.1 and more Source cves: CVE-2021-28165 Source advisory: OSV:GHSA-26VR-8J45-3R4W...

com.aspectran:aspectran-with-jetty (>=7.0.0, <=7.0.1), com.github.gv2011:http (>=0.6, <=0.8) +103 more potentially affected by CVE-2021-28165 via org.eclipse.jetty:jetty-server (>=11.0.0, <=11.0.1)

org.eclipse.jetty:jetty-server MAVEN version =11.0.0, =7.0.0, =0.6, =0.6, =1.0, =1.0, =1.0, =1.0, =4.2.0-beta.1, =0.0.31, =3.0.5, =4.15.31, =4.15.31, =4.15.31, =4.15.50 and more Source cves: CVE-2021-28165 Source advisory: OSV:GHSA-26VR-8J45-3R4W...

com.aspectran:aspectran-with-jetty (>=7.0.0, <=7.0.1), com.github.gv2011:http (>=0.6, <=0.8) +103 more potentially affected by CVE-2021-28165 via org.eclipse.jetty:jetty-server (>=11.0.0, <=11.0.1)

org.eclipse.jetty:jetty-server MAVEN version =11.0.0, =7.0.0, =0.6, =0.6, =1.0, =1.0, =1.0, =1.0, =4.2.0-beta.1, =0.0.31, =3.0.5, =4.15.31, =4.15.31, =4.15.31, =4.15.50 and more Source cves: CVE-2021-28165 Source advisory: GHSA-26VR-8J45-3R4W...

GHSA-26VR-8J45-3R4W Jetty vulnerable to incorrect handling of invalid large TLS frame, exhausting CPU resources

Impact When using SSL/TLS with Jetty, either with HTTP/1.1, HTTP/2, or WebSocket, the server may receive an invalid large greater than 17408 TLS frame that is incorrectly handled, causing CPU resources to eventually reach 100% usage. Workarounds The problem can be worked around by compiling the...

Information Disclosure

jetty-server is vulnerable to information disclosure. The URI normalisation in default compliance mode does not escape % encoded characters in the request metadata by common Servlet implementations, allowing access to sensitive resources within the WEB-INF directory via the use of URI with %2e or...

ai.catboost:catboost-spark_3.1_2.12 (>=1.0.1, <=1.2.8), ai.grakn:grakn-bootup (>=v1.1.0-226-g847ecff2d8e26f249422247d7665fe15f07b1744, <=1.2.0) +10238 more potentially affected by CVE-2021-28165 via org.eclipse.jetty:jetty-server (>=7.2.2.v20101205, <=9.4.38.v20210224)

org.eclipse.jetty:jetty-server MAVEN version =7.2.2.v20101205, =1.0.1, =v1.1.0-226-g847ecff2d8e26f249422247d7665fe15f07b1744, =v1.1.0-226-g847ecff2d8e26f249422247d7665fe15f07b1744, =v1.1.0-226-g847ecff2d8e26f249422247d7665fe15f07b1744, =0.6.1, =0.7.0,...

com.bolyartech.ezlambda:ezlambda-server (1.1.1), com.bolyartech.forge.server:forge-server-jetty (>=9.1.3, <=10.0.2) +71 more potentially affected by CVE-2020-27223 via org.eclipse.jetty:jetty-server (10.0.0)

org.eclipse.jetty:jetty-server MAVEN version 10.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - com.bolyartech.ezlambda:ezlambda-server 1.1.1 - com.bolyartech.forge.server:forge-server-jetty...

ai.h2o:h2o-app (>=3.30.0.7, <=3.46.0.12), ai.h2o:h2o-jetty-9 (>=3.30.0.7, <=3.46.0.12) +4694 more potentially affected by CVE-2020-27223 via org.eclipse.jetty:jetty-server (>=9.4.6.v20170531, <=9.4.36.v20210114)

org.eclipse.jetty:jetty-server MAVEN version =9.4.6.v20170531, =3.30.0.7, =3.30.0.7, =3.38.0.1, =3.30.0.7-1-2.1, =3.30.0.7-1-3.0, =3.34.0.3-1-2.2, =3.34.0.3-1-3.0, =3.30.0.7-1-2.1, =3.30.0.7-1-3.0, =3.30.0.7-1-2.1, =3.30.0.7-1-3.0, =0.0.2, =0.1.0, =0.1.3-20210127.1838-76ab4fc -...

com.github.gv2011:http (>=0.6, <=0.8), com.github.gv2011:tools-rest (0.6) +72 more potentially affected by CVE-2020-27223 via org.eclipse.jetty:jetty-server (11.0.0)

org.eclipse.jetty:jetty-server MAVEN version 11.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - com.github.gv2011:http =0.6, =1.0, =1.0, =1.0, =1.0, =3.0.5, =1.10.9, =1.8.3, =1.10.8 -...

CVE-2020-14359

A vulnerability was found in all versions of Keycloak Gatekeeper, where on using lower case HTTP headers via cURL an attacker can bypass our Gatekeeper. Lower case headers are also accepted by some webservers e.g. Jetty. This means there is no protection when we put a Gatekeeper in front of a Jet...

Design/Logic Flaw

A vulnerability was found in all versions of Keycloak Gatekeeper, where on using lower case HTTP headers via cURL an attacker can bypass our Gatekeeper. Lower case headers are also accepted by some webservers e.g. Jetty. This means there is no protection when we put a Gatekeeper in front of a Jet...

PT-2021-9721 · Red Hat +1 · Keycloak Gatekeeper +1

Name of the Vulnerable Software and Affected Versions: Keycloak Gatekeeper versions all Description: A vulnerability was found in Keycloak Gatekeeper where an attacker can bypass the Gatekeeper by using lower case HTTP headers, for example, via cURL. This issue is particularly problematic when th...

CVE-2020-14359

A vulnerability was found in all versions of Keycloak Gatekeeper, where on using lower case HTTP headers via cURL an attacker can bypass our Gatekeeper. Lower case headers are also accepted by some webservers e.g. Jetty. This means there is no protection when we put a Gatekeeper in front of a Jet...

ai.h2o:h2o-app (>=3.30.0.7, <=3.46.0.12), ai.h2o:h2o-jetty-9 (>=3.30.0.7, <=3.46.0.12) +4400 more potentially affected by CVE-2020-27218 via org.eclipse.jetty:jetty-server (>=9.4.0.v20161208, <=9.4.34.v20201102)

org.eclipse.jetty:jetty-server MAVEN version =9.4.0.v20161208, =3.30.0.7, =3.30.0.7, =3.38.0.1, =3.30.0.7-1-2.1, =3.30.0.7-1-3.0, =3.34.0.3-1-2.2, =3.34.0.3-1-3.0, =3.30.0.7-1-2.1, =3.30.0.7-1-3.0, =3.30.0.7-1-2.1, =3.30.0.7-1-3.0, =0.0.2, =0.1.0, =0.1.3-20210127.1838-76ab4fc -...

Operation on a Resource after Expiration or Release in Jetty Server

In Eclipse Jetty, versions 9.4.27.v20200227 to 9.4.29.v20200521, in case of too large response headers, Jetty throws an exception to produce an HTTP 431 error. When this happens, the ByteBuffer containing the HTTP response headers is released back to the ByteBufferPool twice. Because of this doub...

Information Disclosure

jetty-server is vulnerable to information disclosure. An HTTP 431 error occurs when large response headers are received, causing the HTTP response headers to be released to ByteBufferPool twice. This results in a double release and memory corruption and causes confidential information to be...

Authorization Bypass

jetty-server is vulnerable to authorization bypass. The vulnerability exists as a buffer corruption could occur when the response buffer is too large, allowing the header buffer to be released, but not nulled, causing the server to send incorrect responses to different clients...

jetty: error path information disclosure

In Eclipse Jetty version 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older, the server running on any OS and Jetty version combination will reveal the configured fully qualified directory base resource location on the output of the 404 error for not finding a Context that matches...

jetty: full server path revealed when using the default Error Handling

In Eclipse Jetty Server, all 9.x versions, on webapps deployed using default Error Handling, when an intentionally bad query arrives that doesn't match a dynamic url-pattern, and is eventually handled by the DefaultServlet's static file serving, the bad characters can trigger a...