Detections
Analytics

Debian dsa-5664 : jetty9 - security update

high Nessus Plugin ID 193483

Language:

Synopsis

The remote Debian host is missing a security-related update.

Description

The remote Debian 11 / 12 host has packages installed that are affected by a vulnerability as referenced in the dsa-5664 advisory.

 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512

 - ------------------------------------------------------------------------- Debian Security Advisory DSA-5664-1 [email protected] https://www.debian.org/security/ Markus Koschany April 17, 2024 https://www.debian.org/security/faq
 - -------------------------------------------------------------------------

 Package : jetty9 CVE ID : CVE-2024-22201

 Jetty 9 is a Java based web server and servlet engine. It was discovered that remote attackers may leave many HTTP/2 connections in ESTABLISHED state (not closed), TCP congested and idle. Eventually the server will stop accepting new connections from valid clients which can cause a denial of service.

 For the oldstable distribution (bullseye), this problem has been fixed in version 9.4.50-4+deb11u2.

 For the stable distribution (bookworm), this problem has been fixed in version 9.4.50-4+deb12u3.

 We recommend that you upgrade your jetty9 packages.

 For the detailed security status of jetty9 please refer to its security tracker page at:
 https://security-tracker.debian.org/tracker/jetty9

 Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/

 Mailing list: [email protected]
 -----BEGIN PGP SIGNATURE-----

 iQKTBAEBCgB9FiEErPPQiO8y7e9qGoNf2a0UuVE7UeQFAmYgPqhfFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEFD RjNEMDg4RUYzMkVERUY2QTFBODM1RkQ5QUQxNEI5NTEzQjUxRTQACgkQ2a0UuVE7 UeS8Wg/+JvDyNdRq1Tu6rEqfHprMuxVifvPSH4RefpWMVY1MUIwRSxCyL9GEKCtu q0a+Vf/JycNVbTcRB0n/UpgFdCCWE6dUngLIoYX/SmA+dXKLN9a+FIKj/aivOvOr CUEkaJiVBjARYoBxDzoLG8STAJkxJvCAIduOSZ4Pr3iaZ+3+mHLpz38aAHz7QCXS NoqaD66hMTCVPnVTTr3CvrhCIjcdxQRteJwkJ0XxT5WxYSBmVuB+zEAxHUt6ocv2 5bMel+B4OMcNrRrdQiUtqAF2i7ktAPO2HUo5+9kxYCwkB1DbgIEhdtkA6aBtTYZ0 ZJbx4kV206DrQO7PjLzbY6RA2o2EiNb1zEZlaaFuGq6ctIpR52PplC0sEPUTVbDH LlDAQUIXzmmJGhD2etF5dpknbBTcAhUjGebCiasqwZ8HWiVUeIEwi89je7+CThjB 3phSjyzqZivdkpYiZTApy3UU3lzXHViCtTIverkaQNoYExWVCKihvMRtSAlhw4b0 ukEt+PNzrgl2N0M3bYh1oEh+TGqiP961Je38l5756wKLSxgzfTwTlrPmH6BFwhkF EnMxzjX4jvRWkVC2Yz4/DiJnRnAEjS3iOsvvDnP/lZkWZOXMT3TY0bRJSwUuEgCc NPF/PE/q6KRtzyxJLuTOFRwk/xob/q4GucD+RuqwHEC2w3fN7WE= =HK3G
 -----END PGP SIGNATURE-----

 Reply to:
 [email protected] Markus Koschany (on-list) Markus Koschany (off-list)

 Prev by Date:
 [SECURITY] [DSA 5663-1] firefox-esr security update

 Next by Date:
 [SECURITY] [DSA 5665-1] tomcat10 security update

 Previous by thread:
 [SECURITY] [DSA 5663-1] firefox-esr security update

 Next by thread:
 [SECURITY] [DSA 5665-1] tomcat10 security update

 Index(es):

 Date Thread

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Upgrade the jetty9 packages.

See Also

https://security-tracker.debian.org/tracker/source-package/jetty9

https://security-tracker.debian.org/tracker/CVE-2024-22201

https://packages.debian.org/source/bookworm/jetty9

https://packages.debian.org/source/bullseye/jetty9

Plugin Details

Severity: High

ID: 193483

File Name: debian_DSA-5664.nasl

Version: 1.1

Type: local

Agent: unix

Published: 4/18/2024

Updated: 1/24/2025

Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.4

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2024-22201

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:debian:debian_linux:11.0, p-cpe:/a:debian:debian_linux:libjetty9-java, p-cpe:/a:debian:debian_linux:jetty9, cpe:/o:debian:debian_linux:12.0, p-cpe:/a:debian:debian_linux:libjetty9-extra-java

Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l

Exploit Ease: No known exploits are available

Patch Publication Date: 4/17/2024

Vulnerability Publication Date: 2/26/2024

Reference Information

CVE: CVE-2024-22201