DeutschShown in its original language — a full translation is planned for a future version.
Eclipse Jetty: Mehrere Schwachstellen
view advisory published 2021-04-05
Ein entfernter, authentisierter oder anonymer Angreifer kann mehrere Schwachstellen in Eclipse Jetty ausnutzen, um Informationen offenzulegen und einen Denial of Service Zustand auszulösen.
01
describes (3)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2021-28165US | high7.5 | Exploit | ||
In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invalid TLS frame. | ||||
| CVE-2021-28164US | medium5.3OT high | Exploit | ||
In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources withi… | ||||
| CVE-2021-28163US | low2.7 | — | ||
In Eclipse Jetty 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to 11.0.1, if a user uses a webapps directory that is a symlink, the contents of the webapps directory i… | ||||
02
references
External citations — patches, advisories, analysis.
- Red Hat Security Advisory RHSA-2021:1509 vom 2021-05-05external
- Red Hat Security Advisory RHSA-2021:1551 vom 2021-05-19external
- Red Hat Security Advisory RHSA-2021:1552 vom 2021-05-19external
- Red Hat Security Advisory RHSA-2021:1560 vom 2021-05-13external
- Red Hat Security Advisory RHSA-2021:1561 vom 2021-05-24external
- Red Hat Security Advisory RHSA-2021:2461 vom 2021-06-16external
- Red Hat Security Advisory RHSA-2021:2689 vom 2021-07-12external
- Red Hat Security Advisory RHSA-2021:3140 vom 2021-08-11external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan