The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote attackers to obtain sensitive information from process memory via illegal characters in an HTTP header, aka JetLeak.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote attackers to obtain
    sensitive information from process memory via illegal characters in an HTTP header, aka JetLeak.
    (CVE-2015-2080)

Rebase to upstream version 9.2.9, resolves CVE-2015-2080 security vulnerability.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote instance of Jetty is affected by a remote memory disclosure vulnerability in the HttpParser module due to incorrect handling of illegal characters in header values. When an illegal character is encountered in an HTTP request, Jetty writes a response in a shared buffer that was used in a previous request. Jetty's response to the client includes this shared buffer which contains potentially sensitive data from the previous request. An attacker, using specially crafted requests containing variable length strings of illegal characters, can steal sensitive header data (e.g. cookies, authentication tokens) or sensitive POST data (e.g. credentials).

ID	Name	Product	Family	Severity
422496	SCA: security update for org.eclipse.jetty:jetty-server (GHSA-ghgj-3xqr-6jfm)	Tenable Cloud Security	SCA Checks	high
422496	SCA: security update for org.eclipse.jetty:jetty-server (GHSA-ghgj-3xqr-6jfm)	Tenable Self-Hosted Container Security	SCA Checks	high
81841	Fedora 22 : jetty-9.2.9-1.fc22 (2015-2673)	Nessus	Fedora Local Security Checks	high
81576	Jetty HttpParser Error Remote Memory Disclosure	Nessus	Web Servers	high

Detections

Analytics

CVE-2015-2080

high

Tenable Plugins

high

high

high

high