Description
The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote attackers to obtain sensitive information from process memory via illegal characters in an HTTP header, aka JetLeak.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a n/a
n/aaffected
References
- http://seclists.org/fulldisclosure/2015/Mar/12 ↗
- http://dev.eclipse.org/mhonarc/lists/jetty-announce/msg00074.html ↗
- http://dev.eclipse.org/mhonarc/lists/jetty-announce/msg00075.html ↗
- https://security.netapp.com/advisory/ntap-20190307-0005/ ↗
- http://www.securityfocus.com/bid/72768 ↗
- https://github.com/eclipse/jetty.project/blob/jetty-9.2.x/advisories/2015-02-24-httpparser-error-buffer-bleed.md ↗
- http://www.securitytracker.com/id/1031800 ↗
- http://packetstormsecurity.com/files/130567/Jetty-9.2.8-Shared-Buffer-Leakage.html ↗
- https://blog.gdssecurity.com/labs/2015/2/25/jetleak-vulnerability-remote-leakage-of-shared-buffers-in-je.html ↗
- http://www.securityfocus.com/archive/1/534755/100/1600/threaded ↗
- http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151804.html ↗