Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTVoOWotcTZqMi0yNTNm
Unescaped exception messages in error responses in Jetty
In Eclipse Jetty versions 9.4.21.v20190926, 9.4.22.v20191022, and 9.4.23.v20191118, the generation of default unhandled Error response content (in text/html and text/json Content-Type) does not escape Exception messages in stacktraces included in error output.
Permalink: https://github.com/advisories/GHSA-5h9j-q6j2-253fJSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTVoOWotcTZqMi0yNTNm
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: over 4 years ago
Updated: about 1 year ago
CVSS Score: 6.1
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Identifiers: GHSA-5h9j-q6j2-253f, CVE-2019-17632
References:
- https://nvd.nist.gov/vuln/detail/CVE-2019-17632
- https://bugs.eclipse.org/bugs/show_bug.cgi?id=553443
- https://lists.fedoraproject.org/archives/list/[email protected]/message/SAITZ27GKPD2CCNHGT2VBT4VWIBUJJNS/
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://github.com/advisories/GHSA-5h9j-q6j2-253f
Affected Packages
maven:org.eclipse.jetty:jetty-server
Dependent packages: 3,819Dependent repositories: 34,580
Downloads:
Affected Version Ranges: = 9.4.23.v20191118, = 9.4.22.v20191022, = 9.4.21.v20190926
Fixed in: 9.4.24.v20191120, 9.4.24.v20191120, 9.4.24.v20191120
All affected versions: 9.4.2-1.v20190926, 9.4.2-2.v20191022, 9.4.2-3.v20191118
All unaffected versions: 10.0.0, 10.0.1, 10.0.2, 10.0.3, 10.0.4, 10.0.5, 10.0.6, 10.0.7, 10.0.8, 10.0.9, 10.0.10, 10.0.11, 10.0.12, 10.0.13, 10.0.14, 10.0.15, 10.0.16, 10.0.17, 10.0.18, 10.0.19, 10.0.20, 11.0.0, 11.0.1, 11.0.2, 11.0.3, 11.0.4, 11.0.5, 11.0.6, 11.0.7, 11.0.8, 11.0.9, 11.0.10, 11.0.11, 11.0.12, 11.0.13, 11.0.14, 11.0.15, 11.0.16, 11.0.17, 11.0.18, 11.0.19, 11.0.20, 12.0.0, 12.0.1, 12.0.2, 12.0.3, 12.0.4, 12.0.5, 12.0.6, 12.0.7, 12.0.8