Debian Jetty9 vulnerabilities

CVE-2024-6762 [LOW] CVE-2024-6762: jetty9 - Jetty PushSessionCacheFilter can be exploited by unauthenticated users to launc... Jetty PushSessionCacheFilter can be exploited by unauthenticated users to launch remote DoS attacks by exhausting the server’s memory. Scope: local bookworm: resolved (fixed in 9.4.57-0+deb12u1) bullseye: resolved (fixed in 9.4.57-0+deb11u1) forky: resolved (fixed in 9.4.54-1) sid: resolved (fixed in 9.4.54-1) trixie: resolved (fixed in 9.4.54-1)

CVE-2020-27218 [MEDIUM] CVE-2020-27218: jetty9 - In Eclipse Jetty version 9.4.0.RC0 to 9.4.34.v20201102, 10.0.0.alpha0 to 10.0.0.... In Eclipse Jetty version 9.4.0.RC0 to 9.4.34.v20201102, 10.0.0.alpha0 to 10.0.0.beta2, and 11.0.0.alpha0 to 11.0.0.beta2, if GZIP request body inflation is enabled and requests from different clients are multiplexed onto a single connection, and if an attacker can send a request with a body that is received entirely but not consumed by the application, then a subse

CVE-2019-10247 [MEDIUM] CVE-2019-10247: jetty9 - In Eclipse Jetty version 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.1... In Eclipse Jetty version 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older, the server running on any OS and Jetty version combination will reveal the configured fully qualified directory base resource location on the output of the 404 error for not finding a Context that matches the requested path. The default server behavior on jetty-distribution

CVE-2024-8184 [MEDIUM] CVE-2024-8184: jetty9 - There exists a security vulnerability in Jetty's ThreadLimitHandler.getRemote() ... There exists a security vulnerability in Jetty's ThreadLimitHandler.getRemote() which can be exploited by unauthorized users to cause remote denial-of-service (DoS) attack. By repeatedly sending crafted requests, attackers can trigger OutofMemory errors and exhaust the server's memory. Scope: local bookworm: resolved (fixed in 9.4.57-0+deb12u1) bullseye: resolved (fi

CVE-2025-11143 [LOW] CVE-2025-11143: jetty12 - The Jetty URI parser has some key differences to other common parsers when evalu... The Jetty URI parser has some key differences to other common parsers when evaluating invalid or unusual URIs. Differential parsing of URIs in systems using multiple components may result in security by-pass. For example a component that enforces a black list may interpret the URIs differently from one that generates a response. At the very least, differential parsin

CVE-2023-26048 [MEDIUM] CVE-2023-26048: jetty9 - Jetty is a java based web server and servlet engine. In affected versions servle... Jetty is a java based web server and servlet engine. In affected versions servlets with multipart support (e.g. annotated with `@MultipartConfig`) that call `HttpServletRequest.getParameter()` or `HttpServletRequest.getParts()` may cause `OutOfMemoryError` when the client sends a multipart request with a part that has a name but no filename and very large content.

CVE-2018-12536 [MEDIUM] CVE-2018-12536: jetty9 - In Eclipse Jetty Server, all 9.x versions, on webapps deployed using default Err... In Eclipse Jetty Server, all 9.x versions, on webapps deployed using default Error Handling, when an intentionally bad query arrives that doesn't match a dynamic url-pattern, and is eventually handled by the DefaultServlet's static file serving, the bad characters can trigger a java.nio.file.InvalidPathException which includes the full path to the base resource dir

CVE-2023-40167 [MEDIUM] CVE-2023-40167: jetty9 - Jetty is a Java based web server and servlet engine. Prior to versions 9.4.52, 1... Jetty is a Java based web server and servlet engine. Prior to versions 9.4.52, 10.0.16, 11.0.16, and 12.0.1, Jetty accepts the `+` character proceeding the content-length value in a HTTP/1 header field. This is more permissive than allowed by the RFC and other servers routinely reject such requests with 400 responses. There is no known exploit scenario, but it is c

CVE-2023-26049 [LOW] CVE-2023-26049: jetty9 - Jetty is a java based web server and servlet engine. Nonstandard cookie parsing ... Jetty is a java based web server and servlet engine. Nonstandard cookie parsing in Jetty may allow an attacker to smuggle cookies within other cookies, or otherwise perform unintended behavior by tampering with the cookie parsing mechanism. If Jetty sees a cookie VALUE that starts with `"` (double quote), it will continue to read the cookie string until it sees a clos

CVE-2019-17632 [MEDIUM] CVE-2019-17632: jetty9 - In Eclipse Jetty versions 9.4.21.v20190926, 9.4.22.v20191022, and 9.4.23.v201911... In Eclipse Jetty versions 9.4.21.v20190926, 9.4.22.v20191022, and 9.4.23.v20191118, the generation of default unhandled Error response content (in text/html and text/json Content-Type) does not escape Exception messages in stacktraces included in error output. Scope: local bookworm: resolved (fixed in 9.4.26-1) bullseye: resolved (fixed in 9.4.26-1) forky: resolved

CVE-2023-41900 [LOW] CVE-2023-41900: jetty9 - Jetty is a Java based web server and servlet engine. Versions 9.4.21 through 9.4... Jetty is a Java based web server and servlet engine. Versions 9.4.21 through 9.4.51, 10.0.15, and 11.0.15 are vulnerable to weak authentication. If a Jetty `OpenIdAuthenticator` uses the optional nested `LoginService`, and that `LoginService` decides to revoke an already authenticated user, then the current request will still treat the user as authenticated. The authe

CVE-2021-28163 [LOW] CVE-2021-28163: jetty9 - In Eclipse Jetty 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to 1... In Eclipse Jetty 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to 11.0.1, if a user uses a webapps directory that is a symlink, the contents of the webapps directory is deployed as a static webapp, inadvertently serving the webapps themselves and anything else that might be in that directory. Scope: local bookworm: resolved (fixed in 9.4.39-1) bullseye: r

CVE-2023-36479 [LOW] CVE-2023-36479: jetty9 - Eclipse Jetty Canonical Repository is the canonical repository for the Jetty pro... Eclipse Jetty Canonical Repository is the canonical repository for the Jetty project. Users of the CgiServlet with a very specific command structure may have the wrong command executed. If a user sends a request to a org.eclipse.jetty.servlets.CGI Servlet for a binary with a space in its name, the servlet will escape the command by wrapping it in quotation marks. This

CVE-2021-34428 [LOW] CVE-2021-34428: jetty9 - For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, if an exception is t... For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, if an exception is thrown from the SessionListener#sessionDestroyed() method, then the session ID is not invalidated in the session ID manager. On deployments with clustered sessions and multiple contexts this can result in a session not being invalidated. This can result in an application used on a shared co

CVE-2022-2047 [LOW] CVE-2022-2047: jetty9 - In Eclipse Jetty versions 9.4.0 thru 9.4.46, and 10.0.0 thru 10.0.9, and 11.0.0 ... In Eclipse Jetty versions 9.4.0 thru 9.4.46, and 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, the parsing of the authority segment of an http scheme URI, the Jetty HttpURI class improperly detects an invalid input as a hostname. This can lead to failures in a Proxy scenario. Scope: local bookworm: resolved (fixed in 9.4.48-1) bullseye: resolved (fixed in 9.4.39-