PT-2016-3596 · Eclipse · Eclipse Jetty

Stephen Komal · Publicado 2016-10-07 · Atualizado 2019-03-08 · CVE-2015-2080

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Eclipse Jetty versions prior to 9.2.9.v20150224

Description The exception handling code in Eclipse Jetty allows remote attackers to obtain sensitive information from process memory via illegal characters in an HTTP header. This issue is also known as JetLeak.

Recommendations For Eclipse Jetty versions prior to 9.2.9.v20150224, update to version 9.2.9.v20150224 or later to resolve the issue.

Exploit

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2015-2080

GHSA-GHGJ-3XQR-6JFM

Produtos afetados

Eclipse Jetty

Referências · 15

• 🔥 https://github.com/eclipse/jetty.project/blob/jetty-9.2.x/advisories/2015-02-24-httpparser-error-buffer-bleed.md · Exploit
• 🔥 http://seclists.org/fulldisclosure/2015/Mar/12 · Exploit
• 🔥 https://exploit-db.com/exploits/39455 · Exploit
• 🔥 https://blog.gdssecurity.com/labs/2015/2/25/jetleak-vulnerability-remote-leakage-of-shared-buffers-in-je.html · Exploit
• 🔥 http://packetstormsecurity.com/files/130567/Jetty-9.2.8-Shared-Buffer-Leakage.html · Exploit
• https://security.netapp.com/advisory/ntap-20190307-0005 · Nota
• http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151804.html · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-ghgj-3xqr-6jfm · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2015-2080 · Nota de Segurança
• https://github.com/advisories/GHSA-ghgj-3xqr-6jfm · Nota
• http://dev.eclipse.org/mhonarc/lists/jetty-announce/msg00074.html · Aviso do Fabricante
• http://securitytracker.com/id/1031800 · Nota
• http://dev.eclipse.org/mhonarc/lists/jetty-announce/msg00075.html · Aviso do Fabricante
• http://securityfocus.com/bid/72768 · Nota
• http://securityfocus.com/archive/1/534755/100/1600/threaded · Nota