https://bugzilla.redhat.com/show_bug.cgi?id=1196254
Bug ID: 1196254 Summary: CVE-2015-2080 jetty: remote unauthenticated credential exposure Product: Security Response Component: vulnerability Keywords: Security Severity: high Priority: high Assignee: security-response-team@redhat.com Reporter: vkaigoro@redhat.com CC: atangrin@redhat.com, bleanhar@redhat.com, ccoleman@redhat.com, cperry@redhat.com, dmcphers@redhat.com, eclipse-sig@lists.fedoraproject.org, java-maint@redhat.com, java-sig-commits@lists.fedoraproject.org, jdetiber@redhat.com, jialiu@redhat.com, jkeck@redhat.com, jokerman@redhat.com, krzysztof.daniel@gmail.com, kseifried@redhat.com, lmeyer@redhat.com, mizdebsk@redhat.com, mkollar@redhat.com, mmccomas@redhat.com, msimacek@redhat.com, msrb@redhat.com, overholt@gmail.com, pmackinn@redhat.com, taw@redhat.com, tjay@redhat.com
CVE-2015-2080 has been assigned to this issue in which Jetty sends an HTTP response to one client containing HTTP request data from a different client:
External References:
http://dev.eclipse.org/mhonarc/lists/jetty-announce/msg00074.html https://github.com/eclipse/jetty.project/blob/master/advisories/2015-02-24-h... http://blog.gdssecurity.com/labs/2015/2/25/jetleak-vulnerability-remote-leak...
Statement:
This issue did not affect the versions of jetty as shipped with Red Hat Enterprise Linux 7, versions of openshift-origin-cartridge-fuse as shipped with Red Hat OpenShift Enterprise 2.1, and versions of nutch as shipped with Red Hat Satellite 5.
https://bugzilla.redhat.com/show_bug.cgi?id=1196254
Arun Babu Neelicattu arun.neelicattu+rhbz@gmail.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |arun.neelicattu+rhbz@gmail. | |com
--- Comment #1 from Arun Babu Neelicattu arun.neelicattu+rhbz@gmail.com --- Victims Record:
https://github.com/victims/victims-cve-db/blob/master/database/java/2015/208...
https://bugzilla.redhat.com/show_bug.cgi?id=1196254
--- Comment #2 from Arun Babu Neelicattu arun.neelicattu+rhbz@gmail.com --- Upstream Fix:
https://github.com/eclipse/jetty.project/commit/3e7b5f0fa918633ec24bd1bc23d6... https://github.com/eclipse/jetty.project/commit/4df5647f6dfdc5fa7abb812afe92...
https://bugzilla.redhat.com/show_bug.cgi?id=1196254
Fedora Java SIG java-sig-commits@lists.fedoraproject.org changed:
What |Removed |Added ---------------------------------------------------------------------------- CC|java-sig-commits@lists.fedo | |raproject.org |
--- Comment #3 from Fedora Update System updates@fedoraproject.org --- jetty-9.2.9-1.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report.
java-sig-commits@lists.fedoraproject.org