The remote Debian 11 / 12 host has packages installed that are affected by a vulnerability as referenced in the dsa-5664 advisory.

    -----BEGIN PGP SIGNED MESSAGE-----     Hash: SHA512

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-5664-1                   security@debian.org     https://www.debian.org/security/                          Markus Koschany     April 17, 2024                        https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : jetty9     CVE ID         : CVE-2024-22201

    Jetty 9 is a Java based web server and servlet engine. It was discovered that     remote attackers may leave many HTTP/2 connections in ESTABLISHED state (not     closed), TCP congested and idle. Eventually the server will stop accepting new     connections from valid clients which can cause a denial of service.

    For the oldstable distribution (bullseye), this problem has been fixed     in version 9.4.50-4+deb11u2.

    For the stable distribution (bookworm), this problem has been fixed in     version 9.4.50-4+deb12u3.

    We recommend that you upgrade your jetty9 packages.

    For the detailed security status of jetty9 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/jetty9

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org
    -----BEGIN PGP SIGNATURE-----

    iQKTBAEBCgB9FiEErPPQiO8y7e9qGoNf2a0UuVE7UeQFAmYgPqhfFIAAAAAALgAo     aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEFD     RjNEMDg4RUYzMkVERUY2QTFBODM1RkQ5QUQxNEI5NTEzQjUxRTQACgkQ2a0UuVE7     UeS8Wg/+JvDyNdRq1Tu6rEqfHprMuxVifvPSH4RefpWMVY1MUIwRSxCyL9GEKCtu     q0a+Vf/JycNVbTcRB0n/UpgFdCCWE6dUngLIoYX/SmA+dXKLN9a+FIKj/aivOvOr     CUEkaJiVBjARYoBxDzoLG8STAJkxJvCAIduOSZ4Pr3iaZ+3+mHLpz38aAHz7QCXS     NoqaD66hMTCVPnVTTr3CvrhCIjcdxQRteJwkJ0XxT5WxYSBmVuB+zEAxHUt6ocv2     5bMel+B4OMcNrRrdQiUtqAF2i7ktAPO2HUo5+9kxYCwkB1DbgIEhdtkA6aBtTYZ0     ZJbx4kV206DrQO7PjLzbY6RA2o2EiNb1zEZlaaFuGq6ctIpR52PplC0sEPUTVbDH     LlDAQUIXzmmJGhD2etF5dpknbBTcAhUjGebCiasqwZ8HWiVUeIEwi89je7+CThjB     3phSjyzqZivdkpYiZTApy3UU3lzXHViCtTIverkaQNoYExWVCKihvMRtSAlhw4b0     ukEt+PNzrgl2N0M3bYh1oEh+TGqiP961Je38l5756wKLSxgzfTwTlrPmH6BFwhkF     EnMxzjX4jvRWkVC2Yz4/DiJnRnAEjS3iOsvvDnP/lZkWZOXMT3TY0bRJSwUuEgCc     NPF/PE/q6KRtzyxJLuTOFRwk/xob/q4GucD+RuqwHEC2w3fN7WE=     =HK3G
    -----END PGP SIGNATURE-----

    Reply to:
    debian-security-announce@lists.debian.org     Markus Koschany (on-list)     Markus Koschany (off-list)

    Prev by Date:
    [SECURITY] [DSA 5663-1] firefox-esr security update

    Next by Date:
    [SECURITY] [DSA 5665-1] tomcat10 security update

    Previous by thread:
    [SECURITY] [DSA 5663-1] firefox-esr security update

    Next by thread:
    [SECURITY] [DSA 5665-1] tomcat10 security update

    Index(es):

    Date     Thread

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Detections

Analytics

Debian dsa-5664 : jetty9 - security update

high Nessus Plugin ID 193483

Version 1.1

Version 1.0

Version 1.1 Jan 24, 2025, 9:25 PM CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 severity (based on None, severity decreased from "High" to "Low") Plugin metadata Plugin Feed: 202501242125
Version 1.0 Apr 18, 2024, 5:50 PM New Plugin Feed: 202404181750