Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXhjNjctaGp4Ni1jZ2c2

Installation information leak in Eclipse Jetty

In Eclipse Jetty version 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older, the server running on any OS and Jetty version combination will reveal the configured fully qualified directory base resource location on the output of the 404 error for not finding a Context that matches the requested path. The default server behavior on jetty-distribution and jetty-home will include at the end of the Handler tree a DefaultHandler, which is responsible for reporting this 404 error, it presents the various configured contexts as HTML for users to click through to. This produced HTML includes output that contains the configured fully qualified directory base resource location for each context.

Permalink: https://github.com/advisories/GHSA-xc67-hjx6-cgg6
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXhjNjctaGp4Ni1jZ2c2
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: over 5 years ago
Updated: almost 2 years ago


CVSS Score: 5.3
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Identifiers: GHSA-xc67-hjx6-cgg6, CVE-2019-10247
References: Blast Radius: 24.1

Affected Packages

maven:org.eclipse.jetty:jetty-server
Dependent packages: 3,819
Dependent repositories: 34,580
Downloads:
Affected Version Ranges: >= 9.4.0, <= 9.4.16.v20190411, >= 9.3.0, <= 9.3.26.v20190403, >= 7.0.0, <= 9.2.27.v20190403
Fixed in: 9.4.17.v20190418, 9.3.27.v20190418, 9.2.28.v20190418
All affected versions: 9.2.2-0.v20161216, 9.2.2-1.v20170120, 9.2.2-2.v20170606, 9.2.2-3.v20171218, 9.2.2-4.v20180105, 9.2.2-5.v20180606, 9.2.2-6.v20180806, 9.2.2-7.v20190403, 9.3.2-0.v20170531, 9.3.2-1.M0, 9.3.2-1.RC0, 9.3.2-1.v20170918, 9.3.2-2.v20171030, 9.3.2-3.v20180228, 9.3.2-4.v20180605, 9.3.2-5.v20180904, 9.3.2-6.v20190403, 9.4.1-0.RC0, 9.4.1-0.RC1, 9.4.1-0.v20180503, 9.4.1-1.v20180605, 9.4.1-2.RC0, 9.4.1-2.RC1, 9.4.1-2.RC2, 9.4.1-2.v20180830, 9.4.1-3.v20181111, 9.4.1-4.v20181114, 9.4.1-5.v20190215, 9.4.1-6.v20190411
All unaffected versions: 10.0.0, 10.0.1, 10.0.2, 10.0.3, 10.0.4, 10.0.5, 10.0.6, 10.0.7, 10.0.8, 10.0.9, 10.0.10, 10.0.11, 10.0.12, 10.0.13, 10.0.14, 10.0.15, 10.0.16, 10.0.17, 10.0.18, 10.0.19, 10.0.20, 10.0.21, 10.0.22, 10.0.23, 10.0.24, 11.0.0, 11.0.1, 11.0.2, 11.0.3, 11.0.4, 11.0.5, 11.0.6, 11.0.7, 11.0.8, 11.0.9, 11.0.10, 11.0.11, 11.0.12, 11.0.13, 11.0.14, 11.0.15, 11.0.16, 11.0.17, 11.0.18, 11.0.19, 11.0.20, 11.0.21, 11.0.22, 11.0.23, 11.0.24, 12.0.0, 12.0.1, 12.0.2, 12.0.3, 12.0.4, 12.0.5, 12.0.6, 12.0.7, 12.0.8, 12.0.9, 12.0.10, 12.0.11, 12.0.12, 12.0.13, 12.0.14