https://bugzilla.redhat.com/show_bug.cgi?id=1597418
Bug ID: 1597418
Summary: CVE-2018-12536 jetty: full server path revealed when
using the default Error Handling
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: low
Priority: low
Assignee: security-response-team(a)redhat.com
Reporter: lpardo(a)redhat.com
CC: abergmann(a)suse.com, bkearney(a)redhat.com,
ggainey(a)redhat.com, hghasemb(a)redhat.com,
hhorak(a)redhat.com, java-maint(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jjohnstn(a)redhat.com, jorton(a)redhat.com,
krzysztof.daniel(a)gmail.com, meissner(a)suse.de,
mizdebsk(a)redhat.com, msimacek(a)redhat.com,
sochotni(a)redhat.com, tlestach(a)redhat.com
A flaw was found in Eclipse Jetty Server, all 9.x versions. On webapps deployed
using default Error Handling, when an intentionally bad query arrives that
doesn't match a dynamic url-pattern, and is eventually handled by the
DefaultServlet's static file serving, the bad characters can trigger a
java.nio.file.InvalidPathException which includes the full path to the base
resource directory that the DefaultServlet and/or webapp is using. If this
InvalidPathException is then handled by the default Error Handler, the
InvalidPathException message is included in the error response, revealing the
full server path to the requesting system.
References:
http://www.securitytracker.com/id/1041194
https://bugs.eclipse.org/bugs/show_bug.cgi?id=535670
--
You are receiving this mail because:
You are on the CC list for the bug.