https://bugzilla.redhat.com/show_bug.cgi?id=1196254
Bug ID: 1196254
Summary: CVE-2015-2080 jetty: remote unauthenticated credential
exposure
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: high
Priority: high
Assignee: security-response-team(a)redhat.com
Reporter: vkaigoro(a)redhat.com
CC: atangrin(a)redhat.com, bleanhar(a)redhat.com,
ccoleman(a)redhat.com, cperry(a)redhat.com,
dmcphers(a)redhat.com,
eclipse-sig(a)lists.fedoraproject.org,
java-maint(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jdetiber(a)redhat.com, jialiu(a)redhat.com,
jkeck(a)redhat.com, jokerman(a)redhat.com,
krzysztof.daniel(a)gmail.com, kseifried(a)redhat.com,
lmeyer(a)redhat.com, mizdebsk(a)redhat.com,
mkollar(a)redhat.com, mmccomas(a)redhat.com,
msimacek(a)redhat.com, msrb(a)redhat.com,
overholt(a)gmail.com, pmackinn(a)redhat.com,
taw(a)redhat.com, tjay(a)redhat.com
CVE-2015-2080 has been assigned to this issue in which Jetty sends an
HTTP response to one client containing HTTP request data from a
different client:
External References:
http://dev.eclipse.org/mhonarc/lists/jetty-announce/msg00074.html
https://github.com/eclipse/jetty.project/blob/master/advisories/2015-02-2...
http://blog.gdssecurity.com/labs/2015/2/25/jetleak-vulnerability-remote-l...
Statement:
This issue did not affect the versions of jetty as shipped with Red Hat
Enterprise Linux 7, versions of openshift-origin-cartridge-fuse as shipped with
Red Hat OpenShift Enterprise 2.1, and versions of nutch as shipped with Red Hat
Satellite 5.
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug
https://bugzilla.redhat.com/token.cgi?t=5urGpD4iWp&a=cc_unsubscribe