CVE-2018-12538

In Eclipse Jetty versions 9.4.0 through 9.4.8, when using the optional Jetty provided FileSessionDataStore for persistent storage of HttpSession details, it is possible for a malicious user to access/hijack other HttpSessions and even delete unmatched HttpSessions present in the FileSystem's...

CVE-2018-12538

In Eclipse Jetty versions 9.4.0 through 9.4.8, when using the optional Jetty provided FileSessionDataStore for persistent storage of HttpSession details, it is possible for a malicious user to access/hijack other HttpSessions and even delete unmatched HttpSessions present in the FileSystem's...

at.yawk.dropwizard-nagios:dropwizard-nagios (1.0), br.com.thiaguten:umbrella-monitoring (>=0.1.0, <=1.0.0) +1235 more potentially affected by CVE-2018-12538 via org.eclipse.jetty:jetty-server (>=9.4.0.v20161208, <=9.4.10.v20180503)

org.eclipse.jetty:jetty-server MAVEN version =9.4.0.v20161208, =0.1.0, =0.0.1, =1.1, =1.1, =1.1, =0.9.1, =0.0.5, =0.0.5, =0.0.5, =0.0.7 - cn.spring-up:spring-co 0.1 - cn.spring-up:spring-import 0.1 and more Source cves: CVE-2018-12538 Source advisory: MEND:CVE-2018-12538...

CVE-2018-12538

CVE-2018-12538 affects Eclipse Jetty 9.4.0–9.4.8 when using the FileSessionDataStore for HttpSession persistence. A malicious user could hijack or delete other users’ sessions via the FileSystem storage, due to a flaw in the FileSessionDataStore. Remediation noted in public advisories: upgrade Je...

CVE-2018-12538

In Eclipse Jetty versions 9.4.0 through 9.4.8, when using the optional Jetty provided FileSessionDataStore for persistent storage of HttpSession details, it is possible for a malicious user to access/hijack other HttpSessions and even delete unmatched HttpSessions present in the FileSystem's...

CVE-2018-12538

In Eclipse Jetty versions 9.4.0 through 9.4.8, when using the optional Jetty provided FileSessionDataStore for persistent storage of HttpSession details, it is possible for a malicious user to access/hijack other HttpSessions and even delete unmatched HttpSessions present in the FileSystem's...

CVE-2018-12538: J2EE Misconfiguration: Insufficient Session-ID Length

In Eclipse Jetty versions 9.4.0 through 9.4.8, when using the optional Jetty provided FileSessionDataStore for persistent storage of HttpSession details, it is possible for a malicious user to access/hijack other HttpSessions and even delete unmatched HttpSessions present in the FileSystem's...

Security Bulletin: IBM Content Classification is affected by an Open Source Eclipse Jetty Vulnerabilities

Summary IBM Content Classification has addressed the following vulnerability. Jetty could allow a remote attacker to obtain sensitive information, caused by a timing channel flaw in util/security/Password.java. By observing elapsed times before rejection of incorrect passwords, an attacker could...

Security Bulletin: A vulnerability in Eclipse Jetty affects the IBM InfoSphere Information Server installers

Summary A vulnerability in Eclipse Jetty was addressed by IBM InfoSphere Information Server. Vulnerability Details CVEID: CVE-2017-9735 DESCRIPTION: Jetty could allow a remote attacker to obtain sensitive information, caused by a timing channel flaw in util/security/Password.java. By observing...

Security Bulletin: Vulnerability in SSLv3 affects Warehouse Administration Console and Cubing Services components of IBM InfoSphere Warehouse and IBM DB2 for Linux, Unix and Windows (CVE-2014-3566)

Summary SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption POODLE attack. IBM InfoSphere Warehouse and IBM DB2 for Linux, Unix and Windows do not directly enable SSLv3. However, WAS WebSphere Application Server is bundled with IBM...

Security Bulletin: IBM Development Package for Apache Spark is affected by an Eclipse Jetty vulnerability

Summary IBM Development Package for Apache Spark addresses the following vulnerability by updating the affected component. The primary role of Jetty within Apache Spark is to provide the Web UI via http, or optionally via https. This https communication channel is encrypted using a server-side...

Eclipse Jetty CVE-2017-7656 Security Vulnerability

Description Eclipse Jetty is prone to a security vulnerability. An attacker can exploit this issue to conduct an HTTP request smuggling attack and perform unauthorized actions. This may lead to further attacks. Technologies Affected Eclipse Jetty 9.2.0 Eclipse Jetty 9.3.0 Eclipse Jetty 9.4.0 HP...

PT-2018-3781

Name of the Vulnerable Software and Affected Versions Eclipse Jetty Server versions 9.2.x and older Eclipse Jetty Server versions 9.3.x all non HTTP/1.x configurations Eclipse Jetty Server versions 9.4.x all HTTP/1.x configurations Description The issue is related to the implementation of the...

PT-2018-3159

Name of the Vulnerable Software and Affected Versions Eclipse Jetty Server versions 9.x Description The issue is related to the DefaultServlet's handling of intentionally bad queries that do not match a dynamic url-pattern. When such a query is handled by the DefaultServlet's static file serving,...

PT-2018-3158

Name of the Vulnerable Software and Affected Versions Eclipse Jetty versions 9.4.0 through 9.4.8 Description The issue is related to the use of the optional Jetty provided FileSessionDataStore for persistent storage of HttpSession details. A malicious user can access or hijack other HttpSessions...

Juniper Networks Releases Security Updates

Juniper Networks has released security updates to address vulnerabilities affecting multiple products. A remote attacker could exploit some of these vulnerabilities to take control of an affected system. NCCIC encourages users and administrators to review the following Juniper Security Advisories...

Directory traversal

The Grails Resource Plugin often has to exchange URIs for resources with other internal components. Those other components will decode any URI passed to them. To protect against directory traversal the Grails Resource Plugin did the following: normalized the URI, checked the normalized URI did no...

CVE-2014-3626

The Grails Resource Plugin often has to exchange URIs for resources with other internal components. Those other components will decode any URI passed to them. To protect against directory traversal the Grails Resource Plugin did the following: normalized the URI, checked the normalized URI did no...

CVE-2014-3626

The CVE-2014-3626 vulnerability affects the Grails Resource Plugin (pre-1.2.13). A directory-traversal protection bug caused the plugin to return the decoded URI after the traversal check instead of the normalized URI, enabling a double-decoding issue. The fixed behavior repeatedly decodes the UR...

CVE-2014-3626

The Grails Resource Plugin often has to exchange URIs for resources with other internal components. Those other components will decode any URI passed to them. To protect against directory traversal the Grails Resource Plugin did the following: normalized the URI, checked the normalized URI did no...