All errata/sisyphus/ALT-PU-2021-2000-2
ALT-PU-2021-2000-2

Package update jetty in branch sisyphus

Version9.4.40-alt1_1jpp11
Task#274581
Published2026-02-04
Max severityHIGH
Severity:

Closed issues (6)

BDU:2022-05507
HIGH7.5

Уязвимость контейнера сервлетов Eclipse Jetty, связанная с неконтролируемым расходом ресурсов, позволяющая нарушителю вызвать отказ в обслуживании

Published: 2022-09-05Modified: 2024-09-13
CVSS 3.xHIGH 7.5
CVSS:3.x/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0HIGH 7.8
CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:C
References
BDU:2022-05511
MEDIUM5.3

Уязвимость компонента webapps контейнера сервлетов Eclipse Jetty, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации

Published: 2022-09-05Modified: 2022-10-18
CVSS 3.xMEDIUM 5.3
CVSS:3.x/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS 2.0MEDIUM 5.0
CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N
References
CVE-2021-28163
LOW2.7

In Eclipse Jetty 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to 11.0.1, if a user uses a webapps directory that is a symlink, the contents of the webapps directory is deployed as a static webapp, inadvertently serving the webapps themselves and anything else that might be in that directory.

Published: 2021-04-01Modified: 2024-11-21
CVSS 2.0MEDIUM 4.0
CVSS:2.0/AV:N/AC:L/Au:S/C:P/I:N/A:N
CVSS 3.xLOW 2.7
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
References
CVE-2021-28165
HIGH7.5

In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invalid TLS frame.

Published: 2021-04-01Modified: 2025-08-27
CVSS 2.0HIGH 7.8
CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:C
CVSS 3.xHIGH 7.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
GHSA-26vr-8j45-3r4w
HIGH7.5

Jetty vulnerable to incorrect handling of invalid large TLS frame, exhausting CPU resources

Published: 2021-04-06Modified: 2022-08-11
CVSS 3.xHIGH 7.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
GHSA-j6qj-j888-vvgq
LOW2.7

Directory exposure in jetty

Published: 2021-04-06Modified: 2022-04-22
CVSS 3.xLOW 2.7
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
References