The remote Debian 11 / 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5507 advisory.

  - Jetty is a java based web server and servlet engine. In affected versions servlets with multipart support     (e.g. annotated with `@MultipartConfig`) that call `HttpServletRequest.getParameter()` or     `HttpServletRequest.getParts()` may cause `OutOfMemoryError` when the client sends a multipart request     with a part that has a name but no filename and very large content. This happens even with the default     settings of `fileSizeThreshold=0` which should stream the whole part content to disk. An attacker client     may send a large multipart request and cause the server to throw `OutOfMemoryError`. However, the server     may be able to recover after the `OutOfMemoryError` and continue its service -- although it may take some     time. This issue has been patched in versions 9.4.51, 10.0.14, and 11.0.14. Users are advised to upgrade.
    Users unable to upgrade may set the multipart parameter `maxRequestSize` which must be set to a non-     negative value, so the whole multipart content is limited (although still read into memory).
    (CVE-2023-26048)

  - Jetty is a java based web server and servlet engine. Nonstandard cookie parsing in Jetty may allow an     attacker to smuggle cookies within other cookies, or otherwise perform unintended behavior by tampering     with the cookie parsing mechanism. If Jetty sees a cookie VALUE that starts with `` (double quote), it     will continue to read the cookie string until it sees a closing quote -- even if a semicolon is     encountered. So, a cookie header such as: `DISPLAY_LANGUAGE=b; JSESSIONID=1337; c=d` will be parsed as     one cookie, with the name DISPLAY_LANGUAGE and a value of b; JSESSIONID=1337; c=d instead of 3 separate     cookies. This has security implications because if, say, JSESSIONID is an HttpOnly cookie, and the     DISPLAY_LANGUAGE cookie value is rendered on the page, an attacker can smuggle the JSESSIONID cookie into     the DISPLAY_LANGUAGE cookie and thereby exfiltrate it. This is significant when an intermediary is     enacting some policy based on cookies, so a smuggled cookie can bypass that policy yet still be seen by     the Jetty server or its logging system. This issue has been addressed in versions 9.4.51, 10.0.14,     11.0.14, and 12.0.0.beta0 and users are advised to upgrade. There are no known workarounds for this issue.
    (CVE-2023-26049)

  - Eclipse Jetty Canonical Repository is the canonical repository for the Jetty project. Users of the     CgiServlet with a very specific command structure may have the wrong command executed. If a user sends a     request to a org.eclipse.jetty.servlets.CGI Servlet for a binary with a space in its name, the servlet     will escape the command by wrapping it in quotation marks. This wrapped command, plus an optional command     prefix, will then be executed through a call to Runtime.exec. If the original binary name provided by the     user contains a quotation mark followed by a space, the resulting command line will contain multiple     tokens instead of one. This issue was patched in version 9.4.52, 10.0.16, 11.0.16 and 12.0.0-beta2.
    (CVE-2023-36479)

  - Jetty is a Java based web server and servlet engine. Prior to versions 9.4.52, 10.0.16, 11.0.16, and     12.0.1, Jetty accepts the `+` character proceeding the content-length value in a HTTP/1 header field. This     is more permissive than allowed by the RFC and other servers routinely reject such requests with 400     responses. There is no known exploit scenario, but it is conceivable that request smuggling could result     if jetty is used in combination with a server that does not close the connection after sending such a 400     response. Versions 9.4.52, 10.0.16, 11.0.16, and 12.0.1 contain a patch for this issue. There is no     workaround as there is no known exploit scenario. (CVE-2023-40167)

  - Jetty is a Java based web server and servlet engine. Versions 9.4.21 through 9.4.51, 10.0.15, and 11.0.15     are vulnerable to weak authentication. If a Jetty `OpenIdAuthenticator` uses the optional nested     `LoginService`, and that `LoginService` decides to revoke an already authenticated user, then the current     request will still treat the user as authenticated. The authentication is then cleared from the session     and subsequent requests will not be treated as authenticated. So a request on a previously authenticated     session could be allowed to bypass authentication after it had been rejected by the `LoginService`. This     impacts usages of the jetty-openid which have configured a nested `LoginService` and where that     `LoginService` will is capable of rejecting previously authenticated users. Versions 9.4.52, 10.0.16, and     11.0.16 have a patch for this issue. (CVE-2023-41900)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Debian DSA-5507-1 : jetty9 - security update

medium Nessus Plugin ID 182198

Version 1.2

Version 1.1

Version 1.0

Version 1.2 Mar 21, 2024, 2:00 PM IAVM reference Plugin Feed: 202403211400
Version 1.1 Oct 24, 2023, 4:27 PM IAVM reference Plugin Feed: 202310241627
Version 1.0 Sep 29, 2023, 4:07 PM New Plugin Feed: 202309291607