CVEvulnerability
CVE-2015-2080
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2016-10-07
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 7.5 HIGH — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-200
Description
The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote attackers to obtain sensitive information from process memory via illegal characters in an HTTP header, aka JetLeak.
Affected configurations
• fedoraproject fedora 22
• eclipse jetty 9.2.3
• eclipse jetty 9.2.4
• eclipse jetty 9.2.5
• eclipse jetty 9.2.6
• eclipse jetty 9.2.7
• eclipse jetty 9.2.8
• eclipse jetty 9.3.0
Related
Weakness · CWE (1)
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
References
- http://dev.eclipse.org/mhonarc/lists/jetty-announce/msg00074.html Vendor Advisory
- http://dev.eclipse.org/mhonarc/lists/jetty-announce/msg00075.html Vendor Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151804.html Third Party Advisory
- http://packetstormsecurity.com/files/130567/Jetty-9.2.8-Shared-Buffer-Leakage.html Exploit, Third Party Advisory
- http://seclists.org/fulldisclosure/2015/Mar/12 Exploit, Third Party Advisory
- http://www.securityfocus.com/archive/1/534755/100/1600/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/72768 Broken Link
- http://www.securitytracker.com/id/1031800 Third Party Advisory
- https://blog.gdssecurity.com/labs/2015/2/25/jetleak-vulnerability-remote-leakage-of-shared-buffers-in-je.html Exploit, Third Party Advisory
- https://github.com/eclipse/jetty.project/blob/jetty-9.2.x/advisories/2015-02-24-httpparser-error-buffer-bleed.md Exploit, Vendor Advisory
- https://security.netapp.com/advisory/ntap-20190307-0005/ security.netapp.com
- http://dev.eclipse.org/mhonarc/lists/jetty-announce/msg00074.html Vendor Advisory
- http://dev.eclipse.org/mhonarc/lists/jetty-announce/msg00075.html Vendor Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151804.html Third Party Advisory
- http://packetstormsecurity.com/files/130567/Jetty-9.2.8-Shared-Buffer-Leakage.html Exploit, Third Party Advisory
- http://seclists.org/fulldisclosure/2015/Mar/12 Exploit, Third Party Advisory
- http://www.securityfocus.com/archive/1/534755/100/1600/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/72768 Broken Link
- http://www.securitytracker.com/id/1031800 Third Party Advisory
- https://blog.gdssecurity.com/labs/2015/2/25/jetleak-vulnerability-remote-leakage-of-shared-buffers-in-je.html Exploit, Third Party Advisory
- https://github.com/eclipse/jetty.project/blob/jetty-9.2.x/advisories/2015-02-24-httpparser-error-buffer-bleed.md Exploit, Vendor Advisory
- https://security.netapp.com/advisory/ntap-20190307-0005/ security.netapp.com