Skip to content

[Security] Bump jetty.version from 9.2.11.v20150529 to 9.4.43.v20210629 #83

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 2 commits into
base: master
Choose a base branch
from
Open

[Security] Bump jetty.version from 9.2.11.v20150529 to 9.4.43.v20210629 #83

wants to merge 2 commits into from

Conversation

dependabot-preview[bot]
Copy link

Bumps jetty.version from 9.2.11.v20150529 to 9.4.43.v20210629.
Updates jetty-server from 9.2.11.v20150529 to 9.4.43.v20210629 This update includes security fixes.

Vulnerabilities fixed

Sourced from The GitHub Security Advisory Database.

Moderate severity vulnerability that affects org.eclipse.jetty:jetty-server Jetty through 9.4.x is prone to a timing channel in util/security/Password.java, which makes it easier for remote attackers to obtain access by observing elapsed times before rejection of incorrect passwords.

Affected versions: >= 9.2.0, < 9.2.22.v20170606

Sourced from The GitHub Security Advisory Database.

Installation information leak in Eclipse Jetty In Eclipse Jetty version 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older, the server running on any OS and Jetty version combination will reveal the configured fully qualified directory base resource location on the output of the 404 error for not finding a Context that matches the requested path. The default server behavior on jetty-distribution and jetty-home will include at the end of the Handler tree a DefaultHandler, which is responsible for reporting this 404 error, it presents the various configured contexts as HTML for users to click through to. This produced HTML includes output that contains the configured fully qualified directory base resource location for each context.

Affected versions: >= 7.0.0, <= 9.2.27.v20190403

Sourced from The GitHub Security Advisory Database.

Information Exposure vulnerability in Eclipse Jetty In Eclipse Jetty version 9.2.27, 9.3.26, and 9.4.16, the server running on Windows is vulnerable to exposure of the fully qualified Base Resource directory name on Windows to a remote client when it is configured for showing a Listing of directory contents. This information reveal is restricted to only the content in the configured base resource directories.

Affected versions: >= 9.2.0, <= 9.2.27.v20190403

Sourced from The GitHub Security Advisory Database.

Cross-site Scripting in Eclipse Jetty In Eclipse Jetty version 9.2.26 and older, 9.3.25 and older, and 9.4.15 and older, the server is vulnerable to XSS conditions if a remote client USES a specially formatted URL against the DefaultServlet or ResourceHandler that is configured for showing a Listing of directory contents.

Affected versions: <= 9.2.26.v20180806

Sourced from The GitHub Security Advisory Database.

Critical severity vulnerability that affects org.eclipse.jetty:jetty-server In Eclipse Jetty, versions 9.2.x and older, 9.3.x, transfer-encoding chunks are handled poorly. The chunk length parsing was vulnerable to an integer overflow. Thus a large chunk size could be interpreted as a smaller chunk size and content sent as chunk body could be interpreted as a pipelined request. If Jetty was deployed behind an intermediary that imposed some authorization and that intermediary allowed arbitrarily large chunks to be passed on unchanged, then this flaw could be used to bypass the authorization imposed by the intermediary as the fake pipelined request would not be interpreted by the intermediary as a request.

Affected versions: < 9.2.25.v20180606

Sourced from The GitHub Security Advisory Database.

Moderate severity vulnerability that affects org.eclipse.jetty:jetty-server In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), HTTP/0.9 is handled poorly. An HTTP/1 style request line (i.e. method space URI space version) that declares a version of HTTP/0.9 was accepted and treated as a 0.9 request. If deployed behind an intermediary that also accepted and passed through the 0.9 version (but did not act on it), then the response sent could be interpreted by the intermediary as HTTP/1 headers. This could be used to poison the cache if the server allowed the origin client to generate arbitrary content in the response.

Affected versions: < 9.3.24.v20180605

Sourced from The GitHub Security Advisory Database.

High severity vulnerability that affects org.eclipse.jetty:jetty-server In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), when presented with two content-lengths headers, Jetty ignored the second. When presented with a content-length and a chunked encoding header, the content-length was ignored (as per RFC 2616). If an intermediary decided on the shorter length, but still passed on the longer body, then body content could be interpreted by Jetty as a pipelined request. If the intermediary was imposing authorization, the fake pipelined request would bypass that authorization.

Affected versions: > 9.2.0, < 9.2.25.v20180606

Sourced from The GitHub Security Advisory Database.

Low severity vulnerability that affects org.eclipse.jetty:jetty-server In Eclipse Jetty version 9.2.26 and older, 9.3.25 and older, and 9.4.15 and older, the server is vulnerable to XSS conditions if a remote client USES a specially formatted URL against the DefaultServlet or ResourceHandler that is configured for showing a Listing of directory contents.

Affected versions: < 9.2.27.v20190403

Sourced from The GitHub Security Advisory Database.

Moderate severity vulnerability that affects org.eclipse.jetty:jetty-server In Eclipse Jetty version 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older, the server running on any OS and Jetty version combination will reveal the configured fully qualified directory base resource location on the output of the 404 error for not finding a Context that matches the requested path. The default server behavior on jetty-distribution and jetty-home will include at the end of the Handler tree a DefaultHandler, which is responsible for reporting this 404 error, it presents the various configured contexts as HTML for users to click through to. This produced HTML includes output that contains the configured fully qualified directory base resource location for each context.

Affected versions: >= 7.0.0, < 9.2.28.v20190418

Sourced from The GitHub Security Advisory Database.

Moderate severity vulnerability that affects org.eclipse.jetty:jetty-server In Eclipse Jetty version 9.2.27, 9.3.26, and 9.4.16, the server running on Windows is vulnerable to exposure of the fully qualified Base Resource directory name on Windows to a remote client when it is configured for showing a Listing of directory contents. This information reveal is restricted to only the content in the configured base resource directories.

Affected versions: >= 9.2.0, < 9.2.28.v20190418

Sourced from The GitHub Security Advisory Database.

Moderate severity vulnerability that affects org.eclipse.jetty:jetty-server Jetty through 9.4.x is prone to a timing channel in util/security/Password.java, which makes it easier for remote attackers to obtain access by observing elapsed times before rejection of incorrect passwords.

Affected versions: >= 9.2.0, <= 9.2.21.v20170120

Sourced from The GitHub Security Advisory Database.

Critical severity vulnerability that affects org.eclipse.jetty:jetty-server In Eclipse Jetty, versions 9.2.x and older, 9.3.x, transfer-encoding chunks are handled poorly. The chunk length parsing was vulnerable to an integer overflow. Thus a large chunk size could be interpreted as a smaller chunk size and content sent as chunk body could be interpreted as a pipelined request. If Jetty was deployed behind an intermediary that imposed some authorization and that intermediary allowed arbitrarily large chunks to be passed on unchanged, then this flaw could be used to bypass the authorization imposed by the intermediary as the fake pipelined request would not be interpreted by the intermediary as a request.

Affected versions: <= 9.2.25.v20180105

Sourced from The GitHub Security Advisory Database.

Moderate severity vulnerability that affects org.eclipse.jetty:jetty-server In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), HTTP/0.9 is handled poorly. An HTTP/1 style request line (i.e. method space URI space version) that declares a version of HTTP/0.9 was accepted and treated as a 0.9 request. If deployed behind an intermediary that also accepted and passed through the 0.9 version (but did not act on it), then the response sent could be interpreted by the intermediary as HTTP/1 headers. This could be used to poison the cache if the server allowed the origin client to generate arbitrary content in the response.

Affected versions: <= 9.3.23.v20180228

Sourced from The GitHub Security Advisory Database.

High severity vulnerability that affects org.eclipse.jetty:jetty-server In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), when presented with two content-lengths headers, Jetty ignored the second. When presented with a content-length and a chunked encoding header, the content-length was ignored (as per RFC 2616). If an intermediary decided on the shorter length, but still passed on the longer body, then body content could be interpreted by Jetty as a pipelined request. If the intermediary was imposing authorization, the fake pipelined request would bypass that authorization.

Affected versions: > 9.2.0, <= 9.2.24.v20180105

Sourced from The GitHub Security Advisory Database.

SessionListener can prevent a session from being invalidated breaking logout

Impact

If an exception is thrown from the SessionListener#sessionDestroyed() method, then the session ID is not invalidated in the session ID manager. On deployments with clustered sessions and multiple contexts this can result in a session not being invalidated. This can result in an application used on a shared computer being left logged in.

There is no known path for an attacker to induce such an exception to be thrown, thus they must rely on an application to throw such an exception. The OP has also identified that during the call to sessionDestroyed, the getLastAccessedTime() throws an IllegalStateException, which potentially contrary to the servlet spec, so applications calling this method may always throw and fail to log out. If such an application was only tested on a non clustered test environment, then it may be deployed on a clustered environment with multiple contexts and fail to log out.

Workarounds

The application should catch all Throwables within their SessionListener#sessionDestroyed() implementations.

Affected versions: <= 9.4.40

Release notes

Sourced from jetty-server's releases.

9.4.43.v20210629

Changelog

  • #6473 - Improve alias checking in PathResource
  • #6470 - java.nio.ReadOnlyBufferException
  • #6447 - Deprecate support for UTF16 encoding in URIs
  • #6426 - Update to spifly 1.3.3
  • #6425 - Update to asm 9.1

9.4.42.v20210604

Changelog

  • #6342 - Explain EatWhatYouKill naming
  • #6330 - CustomRequestLog is missing HTTP version format option
  • #6323 - HttpClient gets stuck/never calls onComplete() when multiple requests with timeouts are sent
  • #6308 - Ensure buffers are returned to pool by MessageInputStream
  • #6287 - Class loading broken for WebSocketClient used inside webapp
  • #6285 - HTTP2 client: IllegalStateException: Cannot release an already released entry
  • #6276 - Support non-standard domains in SNI and X509
  • #6268 - Warnings about "unable to parse form content" are not helpful for troubleshooting
  • #6118 - Display a warning when Hazelcast configuration does not contain Jetty session serializer
  • #5931 - SslConnection should implement getBytesIn()/getBytesOut()

9.4.41.v20210516

Changelog

  • This release resolves CVE-2021-28169 and CVE-2021-34428
  • #6099 Cipher preference may break SNI if certificates have different key types
  • #6186 Add Null Protection on Log / Logger
  • #6205 OpenIdAuthenticator may use incorrect redirect
  • #6208 HTTP/2 max local stream count exceeded
  • #6227 Better resolve race between AsyncListener.onTimeout and AsyncContext.dispatch
  • #6254 Total timeout not enforced for queued requests
  • #6263 Review URI encoding in ConcatServlet & WelcomeFilter
  • #6277 Better handle exceptions thrown from session destroy listener
  • #6280 Copy ServletHolder class/instance properly during startWebapp

9.4.40.v20210413

Notable Bug Fixes

Users of GzipHandler should upgrade. (#6168) Users of SSL/TLS on the jetty-server or jetty-client should upgrade. (#6082)

Changelog

  • #6168 - Improve handling of unconsumed content
  • #6148 - Jetty start.jar always reports jetty.tag.version as master
  • #6105 - HttpConnection.getBytesIn() incorrect for requests with chunked content
  • #6082 - SslConnection compacting

... (truncated)

Commits
  • 526006e Updating to version 9.4.43.v20210629
  • 40535f1 Merge pull request #6486 from eclipse/jetty-9.4.x-6470-MessageInputStreamEOF
  • 039a539 Issue #6470 - prevent EOF being released back into pool
  • f045b5a Issue #6473 - Improve alias checking in PathResource. (#6477)
  • 16d8b23 #6455 disable MaxDuration mechanism in testConnectionMaxUsage as it clashes w...
  • 122a78a Issue #6473 - canonicalPath refactor & fix alias check in PathResource (#6474)
  • a02ade7 Merge pull request #6456 from eclipse/jetty-9.4.x-6383-FileBufferedResponseHa...
  • a3effb1 Issue #6447 - Deprecate support for UTF16 encoding in URIs (#6467)
  • 97b52e4 Merge pull request #6462 from eclipse/jetty-9.4.x-documentationFix
  • 4289716 fix documentation format in community.adoc
  • Additional commits viewable in compare view

Updates jetty-servlet from 9.2.11.v20150529 to 9.4.43.v20210629

Release notes

Sourced from jetty-servlet's releases.

9.4.43.v20210629

Changelog

  • #6473 - Improve alias checking in PathResource
  • #6470 - java.nio.ReadOnlyBufferException
  • #6447 - Deprecate support for UTF16 encoding in URIs
  • #6426 - Update to spifly 1.3.3
  • #6425 - Update to asm 9.1

9.4.42.v20210604

Changelog

  • #6342 - Explain EatWhatYouKill naming
  • #6330 - CustomRequestLog is missing HTTP version format option
  • #6323 - HttpClient gets stuck/never calls onComplete() when multiple requests with timeouts are sent
  • #6308 - Ensure buffers are returned to pool by MessageInputStream
  • #6287 - Class loading broken for WebSocketClient used inside webapp
  • #6285 - HTTP2 client: IllegalStateException: Cannot release an already released entry
  • #6276 - Support non-standard domains in SNI and X509
  • #6268 - Warnings about "unable to parse form content" are not helpful for troubleshooting
  • #6118 - Display a warning when Hazelcast configuration does not contain Jetty session serializer
  • #5931 - SslConnection should implement getBytesIn()/getBytesOut()

9.4.41.v20210516

Changelog

  • This release resolves CVE-2021-28169 and CVE-2021-34428
  • #6099 Cipher preference may break SNI if certificates have different key types
  • #6186 Add Null Protection on Log / Logger
  • #6205 OpenIdAuthenticator may use incorrect redirect
  • #6208 HTTP/2 max local stream count exceeded
  • #6227 Better resolve race between AsyncListener.onTimeout and AsyncContext.dispatch
  • #6254 Total timeout not enforced for queued requests
  • #6263 Review URI encoding in ConcatServlet & WelcomeFilter
  • #6277 Better handle exceptions thrown from session destroy listener
  • #6280 Copy ServletHolder class/instance properly during startWebapp

9.4.40.v20210413

Notable Bug Fixes

Users of GzipHandler should upgrade. (#6168) Users of SSL/TLS on the jetty-server or jetty-client should upgrade. (#6082)

Changelog

  • #6168 - Improve handling of unconsumed content
  • #6148 - Jetty start.jar always reports jetty.tag.version as master
  • #6105 - HttpConnection.getBytesIn() incorrect for requests with chunked content
  • #6082 - SslConnection compacting

... (truncated)

Commits
  • 526006e Updating to version 9.4.43.v20210629
  • 40535f1 Merge pull request #6486 from eclipse/jetty-9.4.x-6470-MessageInputStreamEOF
  • 039a539 Issue #6470 - prevent EOF being released back into pool
  • f045b5a Issue #6473 - Improve alias checking in PathResource. (#6477)
  • 16d8b23 #6455 disable MaxDuration mechanism in testConnectionMaxUsage as it clashes w...
  • 122a78a Issue #6473 - canonicalPath refactor & fix alias check in PathResource (#6474)
  • a02ade7 Merge pull request #6456 from eclipse/jetty-9.4.x-6383-FileBufferedResponseHa...
  • a3effb1 Issue #6447 - Deprecate support for UTF16 encoding in URIs (#6467)
  • 97b52e4 Merge pull request #6462 from eclipse/jetty-9.4.x-documentationFix
  • 4289716 fix documentation format in community.adoc
  • Additional commits viewable in compare view

Updates websocket-server from 9.2.11.v20150529 to 9.4.43.v20210629

Updates websocket-client from 9.2.11.v20150529 to 9.4.43.v20210629

Updates jetty-maven-plugin from 9.2.11.v20150529 to 9.4.43.v20210629

Release notes

Sourced from jetty-maven-plugin's releases.

9.4.43.v20210629

Changelog

  • #6473 - Improve alias checking in PathResource
  • #6470 - java.nio.ReadOnlyBufferException
  • #6447 - Deprecate support for UTF16 encoding in URIs
  • #6426 - Update to spifly 1.3.3
  • #6425 - Update to asm 9.1

9.4.42.v20210604

Changelog

  • #6342 - Explain EatWhatYouKill naming
  • #6330 - CustomRequestLog is missing HTTP version format option
  • #6323 - HttpClient gets stuck/never calls onComplete() when multiple requests with timeouts are sent
  • #6308 - Ensure buffers are returned to pool by MessageInputStream
  • #6287 - Class loading broken for WebSocketClient used inside webapp
  • #6285 - HTTP2 client: IllegalStateException: Cannot release an already released entry
  • #6276 - Support non-standard domains in SNI and X509
  • #6268 - Warnings about "unable to parse form content" are not helpful for troubleshooting
  • #6118 - Display a warning when Hazelcast configuration does not contain Jetty session serializer
  • #5931 - SslConnection should implement getBytesIn()/getBytesOut()

9.4.41.v20210516

Changelog

  • This release resolves CVE-2021-28169 and CVE-2021-34428
  • #6099 Cipher preference may break SNI if certificates have different key types
  • #6186 Add Null Protection on Log / Logger
  • #6205 OpenIdAuthenticator may use incorrect redirect
  • #6208 HTTP/2 max local stream count exceeded
  • #6227 Better resolve race between AsyncListener.onTimeout and AsyncContext.dispatch
  • #6254 Total timeout not enforced for queued requests
  • #6263 Review URI encoding in ConcatServlet & WelcomeFilter
  • #6277 Better handle exceptions thrown from session destroy listener
  • #6280 Copy ServletHolder class/instance properly during startWebapp

9.4.40.v20210413

Notable Bug Fixes

Users of GzipHandler should upgrade. (#6168) Users of SSL/TLS on the jetty-server or jetty-client should upgrade. (#6082)

Changelog

  • #6168 - Improve handling of unconsumed content
  • #6148 - Jetty start.jar always reports jetty.tag.version as master
  • #6105 - HttpConnection.getBytesIn() incorrect for requests with chunked content
  • #6082 - SslConnection compacting

... (truncated)

Commits
  • 526006e Updating to version 9.4.43.v20210629
  • 40535f1 Merge pull request #6486 from eclipse/jetty-9.4.x-6470-MessageInputStreamEOF
  • 039a539 Issue #6470 - prevent EOF being released back into pool
  • f045b5a Issue #6473 - Improve alias checking in PathResource. (#6477)
  • 16d8b23 #6455 disable MaxDuration mechanism in testConnectionMaxUsage as it clashes w...
  • 122a78a Issue #6473 - canonicalPath refactor & fix alias check in PathResource (#6474)
  • a02ade7 Merge pull request #6456 from eclipse/jetty-9.4.x-6383-FileBufferedResponseHa...
  • a3effb1 Issue #6447 - Deprecate support for UTF16 encoding in URIs (#6467)
  • 97b52e4 Merge pull request #6462 from eclipse/jetty-9.4.x-documentationFix
  • 4289716 fix documentation format in community.adoc
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Note: This repo was added to Dependabot recently, so you'll receive a maximum of 5 PRs for your first few update runs. Once an update run creates fewer than 5 PRs we'll remove that limit.

You can always request more updates by clicking Bump now in your Dependabot dashboard.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  • @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
  • @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
  • @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
  • @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language
  • @dependabot badge me will comment on this PR with code to add a "Dependabot enabled" badge to your readme

Additionally, you can set the following in your Dependabot dashboard:

  • Update frequency (including time of day and day of week)
  • Pull request limits (per update run and/or open at any time)
  • Automerge options (never/patch/minor, and dev/runtime dependencies)
  • Out-of-range updates (receive only lockfile updates, if desired)
  • Security updates (receive only security updates, if desired)

tharikaGitHub and others added 2 commits July 2, 2021 21:23
@tharikaGitHub
Add integration test for preventing on prem API Renaming
d37da56
@dependabot-preview
[Security] Bump jetty.version from 9.2.11.v20150529 to 9.4.43.v20210629
0d6abcf 
Bumps `jetty.version` from 9.2.11.v20150529 to 9.4.43.v20210629.

Updates `jetty-server` from 9.2.11.v20150529 to 9.4.43.v20210629
- [Release notes](https://github.com/eclipse/jetty.project/releases)
- [Commits](jetty/jetty.project@jetty-9.2.11.v20150529...jetty-9.4.43.v20210629)

Updates `jetty-servlet` from 9.2.11.v20150529 to 9.4.43.v20210629
- [Release notes](https://github.com/eclipse/jetty.project/releases)
- [Commits](jetty/jetty.project@jetty-9.2.11.v20150529...jetty-9.4.43.v20210629)

Updates `websocket-server` from 9.2.11.v20150529 to 9.4.43.v20210629

Updates `websocket-client` from 9.2.11.v20150529 to 9.4.43.v20210629

Updates `jetty-maven-plugin` from 9.2.11.v20150529 to 9.4.43.v20210629
- [Release notes](https://github.com/eclipse/jetty.project/releases)
- [Commits](jetty/jetty.project@jetty-9.2.11.v20150529...jetty-9.4.43.v20210629)

Signed-off-by: dependabot-preview[bot] <[email protected]>
@dependabot-preview dependabot-preview bot added dependencies Pull requests that update a dependency file security Pull requests that address a security vulnerability labels Jul 12, 2021
@dependabot-preview dependabot-preview bot mentioned this pull request Jul 12, 2021
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
dependencies Pull requests that update a dependency file security Pull requests that address a security vulnerability
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@tharikaGitHub