We read every piece of feedback, and take your input very seriously.
To see all available qualifiers, see our documentation.
1 parent b683844 commit 8eb8dfbCopy full SHA for 8eb8dfb
.security/known_cves.yml
@@ -15,3 +15,11 @@
15
* the application is deployed as a WAR or with an embedded Servlet container * ... and so on.
16
The Dumper tools distributes as Jar only, Spring MVC is not used in the code.
17
There is no dependency on Spring MVC in the Dumper tools.
18
+
19
+- CVE: CVE-2024-6763
20
+ artifact: org.eclipse.jetty:jetty-http:9.4.58.v20250814
21
+ justification: >
22
+ The Dumper is a CLI app, not a public-facing web server. It does not accept or process arbitrary URIs from untrusted
23
+ external users. The attack vector for CVE-2024-6763 requires an attacker to supply
24
+ a malformed URI to be parsed by the server; The Dumper does not expose an interface for such input.
25
0 commit comments