GitHub Advisoryadvisory · Maven

GHSA-5h9j-q6j2-253f Unescaped exception messages in error responses in Jetty

MEDIUM Published 2019-12-02 Modified 2021-06-15 Official page ↗
Aliases
CVE-2019-17632
Ecosystem
Maven
Packages
org.eclipse.jetty:jetty-server
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2019-12-02

Affected packages

• Maven org.eclipse.jetty:jetty-server: >= 9.4.21.v20190926, < 9.4.24.v20191120 → fixed in 9.4.24.v20191120 • Maven org.eclipse.jetty:jetty-server: >= 9.4.22.v20191022, < 9.4.24.v20191120 → fixed in 9.4.24.v20191120 • Maven org.eclipse.jetty:jetty-server: >= 9.4.23.v20191118, < 9.4.24.v20191120 → fixed in 9.4.24.v20191120

Description

In Eclipse Jetty versions 9.4.21.v20190926, 9.4.22.v20191022, and 9.4.23.v20191118, the generation of default unhandled Error response content (in text/html and text/json Content-Type) does not escape Exception messages in stacktraces included in error output.

Related

Alias · CVE (1)

  • CVE-2019-17632 In Eclipse Jetty versions 9.4.21.v20190926, 9.4.22.v20191022, and 9.4.23.v20191118, the generation of default unhandled Error response… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References