The remote Debian 11 / 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5507 advisory.

    Multiple security vulnerabilities were found in Jetty, a Java based web server and servlet engine. The     org.eclipse.jetty.servlets.CGI class has been deprecated. It is potentially unsafe to use it. The upstream     developers of Jetty recommend to use Fast CGI instead. See also CVE-2023-36479. CVE-2023-26048 In affected     versions servlets with multipart support (e.g. annotated with `@MultipartConfig`) that call     `HttpServletRequest.getParameter()` or `HttpServletRequest.getParts()` may cause `OutOfMemoryError` when     the client sends a multipart request with a part that has a name but no filename and very large content.
    This happens even with the default settings of `fileSizeThreshold=0` which should stream the whole part     content to disk. CVE-2023-26049 Nonstandard cookie parsing in Jetty may allow an attacker to smuggle     cookies within other cookies, or otherwise perform unintended behavior by tampering with the cookie     parsing mechanism. CVE-2023-40167 Prior to this version Jetty accepted the `+` character proceeding the     content-length value in a HTTP/1 header field. This is more permissive than allowed by the RFC and other     servers routinely reject such requests with 400 responses. There is no known exploit scenario, but it is     conceivable that request smuggling could result if jetty is used in combination with a server that does     not close the connection after sending such a 400 response. CVE-2023-36479 Users of the CgiServlet with a     very specific command structure may have the wrong command executed. If a user sends a request to a     org.eclipse.jetty.servlets.CGI Servlet for a binary with a space in its name, the servlet will escape the     command by wrapping it in quotation marks. This wrapped command, plus an optional command prefix, will     then be executed through a call to Runtime.exec. If the original binary name provided by the user contains     a quotation mark followed by a space, the resulting command line will contain multiple tokens instead of     one. CVE-2023-41900 Jetty is vulnerable to weak authentication. If a Jetty `OpenIdAuthenticator` uses the     optional nested `LoginService`, and that `LoginService` decides to revoke an already authenticated user,     then the current request will still treat the user as authenticated. The authentication is then cleared     from the session and subsequent requests will not be treated as authenticated. So a request on a     previously authenticated session could be allowed to bypass authentication after it had been rejected by     the `LoginService`. This impacts usages of the jetty-openid which have configured a nested `LoginService`     and where that `LoginService` is capable of rejecting previously authenticated users. For the oldstable     distribution (bullseye), these problems have been fixed in version 9.4.39-3+deb11u2. For the stable     distribution (bookworm), these problems have been fixed in version 9.4.50-4+deb12u1. We recommend that you     upgrade your jetty9 packages. For the detailed security status of jetty9 please refer to its security     tracker page at: https://security-tracker.debian.org/tracker/jetty9

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Debian DSA-5507-1 : jetty9 - security update

medium Nessus Plugin ID 182198

Version 1.3

Version 1.2

Version 1.1

Version 1.0

Version 1.3 Jan 24, 2025, 11:52 PM CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 severity (based on None, severity decreased from "High" to "Low") Plugin metadata Plugin Feed: 202501242352
Version 1.2 Mar 21, 2024, 2:00 PM IAVM reference Plugin Feed: 202403211400
Version 1.1 Oct 24, 2023, 4:27 PM IAVM reference Plugin Feed: 202310241627
Version 1.0 Sep 29, 2023, 4:07 PM New Plugin Feed: 202309291607