In Eclipse Jetty, versions 9.4.27.v20200227 to 9.4.29.v20200521, in case of too large response headers, Jetty throws an exception to produce an HTTP 431 error. When this happens, the ByteBuffer containing the HTTP response headers is released back to the ByteBufferPool twice. Because of this double release, two threads can acquire the same ByteBuffer from the pool and while thread1 is about to use the ByteBuffer to write response1 data, thread2 fills the ByteBuffer with other data. Thread1 then proceeds to write the buffer that now contains different data. This results in client1, which issued request1 seeing data from another request or response which could contain sensitive data belonging to client2 (HTTP session ids, authentication credentials, etc.). If the Jetty version cannot be upgraded, the vulnerability can be significantly reduced by configuring a responseHeaderSize significantly larger than the requestHeaderSize (12KB responseHeaderSize and 8KB requestHeaderSize).

The version of Jetty installed on the remote host when handling too large response headers throws an exception to produce an HTTP 431 error. When this happens, the ByteBuffer containing the HTTP response headers is released back to the ByteBufferPool twice. Because of this double release, two threads can acquire the same ByteBuffer from the pool and potentially leak sensitive data between the two clients. Note that the scanner has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:4223 advisory.

  - jetty: double release of resource can lead to information disclosure (CVE-2019-17638)

  - jenkins: user-specified tooltip values leads to stored cross-site scripting (CVE-2020-2229)

  - jenkins: stored XSS vulnerability in project naming strategy (CVE-2020-2230)

  - jenkins: stored XSS vulnerability in 'trigger builds remotely' (CVE-2020-2231)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:3841 advisory.

  - jetty: double release of resource can lead to information disclosure (CVE-2019-17638)

  - jenkins: user-specified tooltip values leads to stored cross-site scripting (CVE-2020-2229)

  - jenkins: stored XSS vulnerability in project naming strategy (CVE-2020-2230)

  - jenkins: stored XSS vulnerability in 'trigger builds remotely' (CVE-2020-2231)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:3808 advisory.

  - jetty: double release of resource can lead to information disclosure (CVE-2019-17638)

  - jenkins: Stored XSS vulnerability in job build time trend (CVE-2020-2220)

  - jenkins: Stored XSS vulnerability in upstream cause (CVE-2020-2221)

  - jenkins: Stored XSS vulnerability in 'keep forever' badge icons (CVE-2020-2222)

  - jenkins: Stored XSS vulnerability in console links (CVE-2020-2223)

  - jenkins: user-specified tooltip values leads to stored cross-site scripting (CVE-2020-2229)

  - jenkins: stored XSS vulnerability in project naming strategy (CVE-2020-2230)

  - jenkins: stored XSS vulnerability in 'trigger builds remotely' (CVE-2020-2231)

  - kubernetes: Node disk DOS by writing to container /etc/hosts (CVE-2020-8557)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updates to the latest upstream release of Eclipse. See the upstream release notes for details:
https://www.eclipse.org/eclipseide/2020-06/noteworthy/

Also contains security fixes for CVE-2019-17566 and CVE-2019-17638.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Jenkins running on the remote web server is 2.224 through 2.242 or is a version of Jenkins LTS  2.222.1 through 2.235.4. It is, therefore, affected by an information disclosure vulnerability exists due to an vulnerable Jetty 9.4.27  library. An unauthenticated, remote attacker can exploit this to disclose potentially sensitive information intended for  other users.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Jenkins Security Advisory : Description(Critical) SECURITY-1983 / CVE-2019-17638 Buffer corruption in bundled Jetty

ID	Name	Product	Family	Severity
113003	Jetty 9.4.27 < 9.4.30 Buffer Overflow	Web App Scanning	Component Vulnerability	critical
141814	RHEL 7 : OpenShift Container Platform 3.11.306 jenkins (RHSA-2020:4223)	Nessus	Red Hat Local Security Checks	critical
141125	RHEL 7 : OpenShift Container Platform 4.5.13 jenkins (RHSA-2020:3841)	Nessus	Red Hat Local Security Checks	critical
140749	RHEL 7 / 8 : OpenShift Container Platform 4.3.38 jenkins and openshift (RHSA-2020:3808)	Nessus	Red Hat Local Security Checks	critical
140107	Fedora 32 : 1:ecj / 1:eclipse / 1:eclipse-emf / 2:eclipse-cdt / batik / etc (2020-cf8ef2f333)	Nessus	Fedora Local Security Checks	critical
139734	Jenkins < 2.235.5 LTS / 2.243 Information Disclosure Vulnerability	Nessus	CGI abuses	critical
139640	FreeBSD : jenkins -- Buffer corruption in bundled Jetty (09ea1b08-1d3e-4bf2-91a1-d6573f4da3d8)	Nessus	FreeBSD Local Security Checks	critical

Detections

Analytics

CVE-2019-17638

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical