https://bugzilla.redhat.com/show_bug.cgi?id=1945712
Przemyslaw Roguski <proguski(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |abenaiss(a)redhat.com,
| |aos-bugs(a)redhat.com,
| |pbhattac(a)redhat.com,
| |sd-operator-metering@redhat
| |.com, tflannag(a)redhat.com,
| |vbobade(a)redhat.com
--- Doc Text *updated* ---
In Jetty the default compliance mode allows requests with URIs that contain %2e or %2e%2e
segments to access protected resources within the WEB-INF directory. An attacker can use
this vulnerability to reveal sensitive information regarding the implementation of a web
application.
--- Comment #3 from Przemyslaw Roguski <proguski(a)redhat.com> ---
The issue was introduced with version 9.4.37. Older versions of jetty are not
affected.
--
You are receiving this mail because:
You are on the CC list for the bug.