PT-2016-3596 · Eclipse · Eclipse Jetty

Stephen Komal · Published 2016-10-07 · Updated 2019-03-08 · CVE-2015-2080

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Eclipse Jetty versions prior to 9.2.9.v20150224

Description The exception handling code in Eclipse Jetty allows remote attackers to obtain sensitive information from process memory via illegal characters in an HTTP header. This issue is also known as JetLeak.

Recommendations For Eclipse Jetty versions prior to 9.2.9.v20150224, update to version 9.2.9.v20150224 or later to resolve the issue.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2015-2080

GHSA-GHGJ-3XQR-6JFM

Affected Products

Eclipse Jetty

References · 15

• 🔥 https://github.com/eclipse/jetty.project/blob/jetty-9.2.x/advisories/2015-02-24-httpparser-error-buffer-bleed.md · Exploit
• 🔥 http://seclists.org/fulldisclosure/2015/Mar/12 · Exploit
• 🔥 https://exploit-db.com/exploits/39455 · Exploit
• 🔥 https://blog.gdssecurity.com/labs/2015/2/25/jetleak-vulnerability-remote-leakage-of-shared-buffers-in-je.html · Exploit
• 🔥 http://packetstormsecurity.com/files/130567/Jetty-9.2.8-Shared-Buffer-Leakage.html · Exploit
• http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151804.html · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-ghgj-3xqr-6jfm · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-2080 · Security Note
• http://dev.eclipse.org/mhonarc/lists/jetty-announce/msg00074.html · Vendor Advisory
• http://dev.eclipse.org/mhonarc/lists/jetty-announce/msg00075.html · Vendor Advisory
• https://security.netapp.com/advisory/ntap-20190307-0005 · Note
• https://github.com/advisories/GHSA-ghgj-3xqr-6jfm · Note
• http://securitytracker.com/id/1031800 · Note
• http://securityfocus.com/bid/72768 · Note
• http://securityfocus.com/archive/1/534755/100/1600/threaded · Note