Skip to content

[Security] Bump jetty.version from 9.2.11.v20150529 to 9.4.42.v20210604 #79

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
wants to merge 1 commit into from
Closed

[Security] Bump jetty.version from 9.2.11.v20150529 to 9.4.42.v20210604 #79

wants to merge 1 commit into from

Conversation

dependabot-preview[bot]
Copy link

Bumps jetty.version from 9.2.11.v20150529 to 9.4.42.v20210604.
Updates jetty-server from 9.2.11.v20150529 to 9.4.42.v20210604 This update includes security fixes.

Vulnerabilities fixed

Sourced from The GitHub Security Advisory Database.

Moderate severity vulnerability that affects org.eclipse.jetty:jetty-server Jetty through 9.4.x is prone to a timing channel in util/security/Password.java, which makes it easier for remote attackers to obtain access by observing elapsed times before rejection of incorrect passwords.

Affected versions: >= 9.2.0, < 9.2.22.v20170606

Sourced from The GitHub Security Advisory Database.

Installation information leak in Eclipse Jetty In Eclipse Jetty version 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older, the server running on any OS and Jetty version combination will reveal the configured fully qualified directory base resource location on the output of the 404 error for not finding a Context that matches the requested path. The default server behavior on jetty-distribution and jetty-home will include at the end of the Handler tree a DefaultHandler, which is responsible for reporting this 404 error, it presents the various configured contexts as HTML for users to click through to. This produced HTML includes output that contains the configured fully qualified directory base resource location for each context.

Affected versions: >= 7.0.0, <= 9.2.27.v20190403

Sourced from The GitHub Security Advisory Database.

Information Exposure vulnerability in Eclipse Jetty In Eclipse Jetty version 9.2.27, 9.3.26, and 9.4.16, the server running on Windows is vulnerable to exposure of the fully qualified Base Resource directory name on Windows to a remote client when it is configured for showing a Listing of directory contents. This information reveal is restricted to only the content in the configured base resource directories.

Affected versions: >= 9.2.0, <= 9.2.27.v20190403

Sourced from The GitHub Security Advisory Database.

Cross-site Scripting in Eclipse Jetty In Eclipse Jetty version 9.2.26 and older, 9.3.25 and older, and 9.4.15 and older, the server is vulnerable to XSS conditions if a remote client USES a specially formatted URL against the DefaultServlet or ResourceHandler that is configured for showing a Listing of directory contents.

Affected versions: <= 9.2.26.v20180806

Sourced from The GitHub Security Advisory Database.

Critical severity vulnerability that affects org.eclipse.jetty:jetty-server In Eclipse Jetty, versions 9.2.x and older, 9.3.x, transfer-encoding chunks are handled poorly. The chunk length parsing was vulnerable to an integer overflow. Thus a large chunk size could be interpreted as a smaller chunk size and content sent as chunk body could be interpreted as a pipelined request. If Jetty was deployed behind an intermediary that imposed some authorization and that intermediary allowed arbitrarily large chunks to be passed on unchanged, then this flaw could be used to bypass the authorization imposed by the intermediary as the fake pipelined request would not be interpreted by the intermediary as a request.

Affected versions: < 9.2.25.v20180606

Sourced from The GitHub Security Advisory Database.

Moderate severity vulnerability that affects org.eclipse.jetty:jetty-server In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), HTTP/0.9 is handled poorly. An HTTP/1 style request line (i.e. method space URI space version) that declares a version of HTTP/0.9 was accepted and treated as a 0.9 request. If deployed behind an intermediary that also accepted and passed through the 0.9 version (but did not act on it), then the response sent could be interpreted by the intermediary as HTTP/1 headers. This could be used to poison the cache if the server allowed the origin client to generate arbitrary content in the response.

Affected versions: < 9.3.24.v20180605

Sourced from The GitHub Security Advisory Database.

High severity vulnerability that affects org.eclipse.jetty:jetty-server In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), when presented with two content-lengths headers, Jetty ignored the second. When presented with a content-length and a chunked encoding header, the content-length was ignored (as per RFC 2616). If an intermediary decided on the shorter length, but still passed on the longer body, then body content could be interpreted by Jetty as a pipelined request. If the intermediary was imposing authorization, the fake pipelined request would bypass that authorization.

Affected versions: > 9.2.0, < 9.2.25.v20180606

Sourced from The GitHub Security Advisory Database.

Low severity vulnerability that affects org.eclipse.jetty:jetty-server In Eclipse Jetty version 9.2.26 and older, 9.3.25 and older, and 9.4.15 and older, the server is vulnerable to XSS conditions if a remote client USES a specially formatted URL against the DefaultServlet or ResourceHandler that is configured for showing a Listing of directory contents.

Affected versions: < 9.2.27.v20190403

Sourced from The GitHub Security Advisory Database.

Moderate severity vulnerability that affects org.eclipse.jetty:jetty-server In Eclipse Jetty version 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older, the server running on any OS and Jetty version combination will reveal the configured fully qualified directory base resource location on the output of the 404 error for not finding a Context that matches the requested path. The default server behavior on jetty-distribution and jetty-home will include at the end of the Handler tree a DefaultHandler, which is responsible for reporting this 404 error, it presents the various configured contexts as HTML for users to click through to. This produced HTML includes output that contains the configured fully qualified directory base resource location for each context.

Affected versions: >= 7.0.0, < 9.2.28.v20190418

Sourced from The GitHub Security Advisory Database.

Moderate severity vulnerability that affects org.eclipse.jetty:jetty-server In Eclipse Jetty version 9.2.27, 9.3.26, and 9.4.16, the server running on Windows is vulnerable to exposure of the fully qualified Base Resource directory name on Windows to a remote client when it is configured for showing a Listing of directory contents. This information reveal is restricted to only the content in the configured base resource directories.

Affected versions: >= 9.2.0, < 9.2.28.v20190418

Release notes

Sourced from jetty-server's releases.

9.4.41.v20210516

Changelog

  • #6099 Cipher preference may break SNI if certificates have different key types
  • #6186 Add Null Protection on Log / Logger
  • #6205 OpenIdAuthenticator may use incorrect redirect
  • #6208 HTTP/2 max local stream count exceeded
  • #6227 Better resolve race between AsyncListener.onTimeout and AsyncContext.dispatch
  • #6254 Total timeout not enforced for queued requests
  • #6263 Review URI encoding in ConcatServlet & WelcomeFilter
  • #6277 Better handle exceptions thrown from session destroy listener
  • #6280 Copy ServletHolder class/instance properly during startWebapp

9.4.40.v20210413

Notable Bug Fixes

Users of GzipHandler should upgrade. (#6168) Users of SSL/TLS on the jetty-server or jetty-client should upgrade. (#6082)

Changelog

  • #6168 - Improve handling of unconsumed content
  • #6148 - Jetty start.jar always reports jetty.tag.version as master
  • #6105 - HttpConnection.getBytesIn() incorrect for requests with chunked content
  • #6082 - SslConnection compacting

9.4.39.v20210325

Changelog

⚠️ Important Security related Changes

Other Changes

  • #6034 - SslContextFactory may select a wildcard certificate during SNI selection when a more specific SSL certificate is present
  • #6050 - Websocket: NotUtf8Exception after upgrade 9.4.35 -> 9.4.36 or newer
  • #6052 - Cleanup TypeUtil and ModuleLocation to allow jetty-client/hybrid to work on Android
  • #6063 - Allow override of hazelcast version when using module
  • #6085 - Jetty keeps Sessions in use after "Duplicate valid session cookies" Message

9.4.38.v20210224

Changelog

  • #6001 - Ambiguous URI legacy compliance mode
  • #5999 - HttpURI ArrayIndexOutOfBounds

... (truncated)

Commits
  • 5cd5e6d Updating to version 9.4.42.v20210604
  • 9b6b956 Fixes #6330 - CustomRequestLog is missing HTTP version format option. (#6361)
  • 40a9fa7 Explain EatWhatYouKill naming (#6342)
  • 2e7d174 Fixes #6323 - HttpClient requests with redirects gets stuck/never cal… (#6334)
  • f902d12 Fixes #5931 - SslConnection should implement getBytesIn()/getBytesOut(). (#6335)
  • 121d8c2 Merge pull request #6325 from eclipse/jetty-9.4.x-6287-WebSocketClientClassLo...
  • 76f5162 Issue #6118 Warn if hazelcast cfg file is missing SessionDataSerializer (#632...
  • 8f0bb81 align names with jetty-10
  • 01c35fe do not trim surefire stack trace
  • 44bc0e8 add null check
  • Additional commits viewable in compare view

Updates jetty-servlet from 9.2.11.v20150529 to 9.4.42.v20210604

Release notes

Sourced from jetty-servlet's releases.

9.4.41.v20210516

Changelog

  • #6099 Cipher preference may break SNI if certificates have different key types
  • #6186 Add Null Protection on Log / Logger
  • #6205 OpenIdAuthenticator may use incorrect redirect
  • #6208 HTTP/2 max local stream count exceeded
  • #6227 Better resolve race between AsyncListener.onTimeout and AsyncContext.dispatch
  • #6254 Total timeout not enforced for queued requests
  • #6263 Review URI encoding in ConcatServlet & WelcomeFilter
  • #6277 Better handle exceptions thrown from session destroy listener
  • #6280 Copy ServletHolder class/instance properly during startWebapp

9.4.40.v20210413

Notable Bug Fixes

Users of GzipHandler should upgrade. (#6168) Users of SSL/TLS on the jetty-server or jetty-client should upgrade. (#6082)

Changelog

  • #6168 - Improve handling of unconsumed content
  • #6148 - Jetty start.jar always reports jetty.tag.version as master
  • #6105 - HttpConnection.getBytesIn() incorrect for requests with chunked content
  • #6082 - SslConnection compacting

9.4.39.v20210325

Changelog

⚠️ Important Security related Changes

Other Changes

  • #6034 - SslContextFactory may select a wildcard certificate during SNI selection when a more specific SSL certificate is present
  • #6050 - Websocket: NotUtf8Exception after upgrade 9.4.35 -> 9.4.36 or newer
  • #6052 - Cleanup TypeUtil and ModuleLocation to allow jetty-client/hybrid to work on Android
  • #6063 - Allow override of hazelcast version when using module
  • #6085 - Jetty keeps Sessions in use after "Duplicate valid session cookies" Message

9.4.38.v20210224

Changelog

  • #6001 - Ambiguous URI legacy compliance mode
  • #5999 - HttpURI ArrayIndexOutOfBounds

... (truncated)

Commits
  • 5cd5e6d Updating to version 9.4.42.v20210604
  • 9b6b956 Fixes #6330 - CustomRequestLog is missing HTTP version format option. (#6361)
  • 40a9fa7 Explain EatWhatYouKill naming (#6342)
  • 2e7d174 Fixes #6323 - HttpClient requests with redirects gets stuck/never cal… (#6334)
  • f902d12 Fixes #5931 - SslConnection should implement getBytesIn()/getBytesOut(). (#6335)
  • 121d8c2 Merge pull request #6325 from eclipse/jetty-9.4.x-6287-WebSocketClientClassLo...
  • 76f5162 Issue #6118 Warn if hazelcast cfg file is missing SessionDataSerializer (#632...
  • 8f0bb81 align names with jetty-10
  • 01c35fe do not trim surefire stack trace
  • 44bc0e8 add null check
  • Additional commits viewable in compare view

Updates websocket-server from 9.2.11.v20150529 to 9.4.42.v20210604

Updates websocket-client from 9.2.11.v20150529 to 9.4.42.v20210604

Updates jetty-maven-plugin from 9.2.11.v20150529 to 9.4.42.v20210604

Release notes

Sourced from jetty-maven-plugin's releases.

9.4.41.v20210516

Changelog

  • #6099 Cipher preference may break SNI if certificates have different key types
  • #6186 Add Null Protection on Log / Logger
  • #6205 OpenIdAuthenticator may use incorrect redirect
  • #6208 HTTP/2 max local stream count exceeded
  • #6227 Better resolve race between AsyncListener.onTimeout and AsyncContext.dispatch
  • #6254 Total timeout not enforced for queued requests
  • #6263 Review URI encoding in ConcatServlet & WelcomeFilter
  • #6277 Better handle exceptions thrown from session destroy listener
  • #6280 Copy ServletHolder class/instance properly during startWebapp

9.4.40.v20210413

Notable Bug Fixes

Users of GzipHandler should upgrade. (#6168) Users of SSL/TLS on the jetty-server or jetty-client should upgrade. (#6082)

Changelog

  • #6168 - Improve handling of unconsumed content
  • #6148 - Jetty start.jar always reports jetty.tag.version as master
  • #6105 - HttpConnection.getBytesIn() incorrect for requests with chunked content
  • #6082 - SslConnection compacting

9.4.39.v20210325

Changelog

⚠️ Important Security related Changes

Other Changes

  • #6034 - SslContextFactory may select a wildcard certificate during SNI selection when a more specific SSL certificate is present
  • #6050 - Websocket: NotUtf8Exception after upgrade 9.4.35 -> 9.4.36 or newer
  • #6052 - Cleanup TypeUtil and ModuleLocation to allow jetty-client/hybrid to work on Android
  • #6063 - Allow override of hazelcast version when using module
  • #6085 - Jetty keeps Sessions in use after "Duplicate valid session cookies" Message

9.4.38.v20210224

Changelog

  • #6001 - Ambiguous URI legacy compliance mode
  • #5999 - HttpURI ArrayIndexOutOfBounds

... (truncated)

Commits
  • 5cd5e6d Updating to version 9.4.42.v20210604
  • 9b6b956 Fixes #6330 - CustomRequestLog is missing HTTP version format option. (#6361)
  • 40a9fa7 Explain EatWhatYouKill naming (#6342)
  • 2e7d174 Fixes #6323 - HttpClient requests with redirects gets stuck/never cal… (#6334)
  • f902d12 Fixes #5931 - SslConnection should implement getBytesIn()/getBytesOut(). (#6335)
  • 121d8c2 Merge pull request #6325 from eclipse/jetty-9.4.x-6287-WebSocketClientClassLo...
  • 76f5162 Issue #6118 Warn if hazelcast cfg file is missing SessionDataSerializer (#632...
  • 8f0bb81 align names with jetty-10
  • 01c35fe do not trim surefire stack trace
  • 44bc0e8 add null check
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Note: This repo was added to Dependabot recently, so you'll receive a maximum of 5 PRs for your first few update runs. Once an update run creates fewer than 5 PRs we'll remove that limit.

You can always request more updates by clicking Bump now in your Dependabot dashboard.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  • @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
  • @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
  • @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
  • @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language
  • @dependabot badge me will comment on this PR with code to add a "Dependabot enabled" badge to your readme

Additionally, you can set the following in your Dependabot dashboard:

  • Update frequency (including time of day and day of week)
  • Pull request limits (per update run and/or open at any time)
  • Automerge options (never/patch/minor, and dev/runtime dependencies)
  • Out-of-range updates (receive only lockfile updates, if desired)
  • Security updates (receive only security updates, if desired)

@dependabot-preview
[Security] Bump jetty.version from 9.2.11.v20150529 to 9.4.42.v20210604
94d04d9 
Bumps `jetty.version` from 9.2.11.v20150529 to 9.4.42.v20210604.

Updates `jetty-server` from 9.2.11.v20150529 to 9.4.42.v20210604
- [Release notes](https://github.com/eclipse/jetty.project/releases)
- [Commits](jetty/jetty.project@jetty-9.2.11.v20150529...jetty-9.4.42.v20210604)

Updates `jetty-servlet` from 9.2.11.v20150529 to 9.4.42.v20210604
- [Release notes](https://github.com/eclipse/jetty.project/releases)
- [Commits](jetty/jetty.project@jetty-9.2.11.v20150529...jetty-9.4.42.v20210604)

Updates `websocket-server` from 9.2.11.v20150529 to 9.4.42.v20210604

Updates `websocket-client` from 9.2.11.v20150529 to 9.4.42.v20210604

Updates `jetty-maven-plugin` from 9.2.11.v20150529 to 9.4.42.v20210604
- [Release notes](https://github.com/eclipse/jetty.project/releases)
- [Commits](jetty/jetty.project@jetty-9.2.11.v20150529...jetty-9.4.42.v20210604)

Signed-off-by: dependabot-preview[bot] <[email protected]>
@dependabot-preview dependabot-preview bot added dependencies Pull requests that update a dependency file security Pull requests that address a security vulnerability labels Jun 9, 2021
@dependabot-preview dependabot-preview bot mentioned this pull request Jun 9, 2021
Closed
@dependabot-preview
Copy link
Author

Superseded by #83.

@dependabot-preview dependabot-preview bot deleted the dependabot/maven/jetty.version-9.4.42.v20210604 branch July 12, 2021 06:38
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
dependencies Pull requests that update a dependency file security Pull requests that address a security vulnerability
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
0 participants