wid-sec-w-2023-2359
Vulnerability from csaf_certbund
Published
2023-09-14 22:00
Modified
2024-06-13 22:00
Summary
Eclipse Jetty: Mehrere Schwachstellen

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung
Eclipse Jetty ist ein Java-HTTP-Server und Java-Servlet-Container.
Angriff
Ein entfernter authentifizierter Angreifer kann mehrere Schwachstellen in Eclipse Jetty ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen oder einen HTTP-Cache-Poison-Angriff durchzuführen.
Betroffene Betriebssysteme
- Linux - MacOS X - UNIX - Windows


To clipboard 

{
  "document": {
    "aggregate_severity": {
      "text": "mittel"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Eclipse Jetty ist ein Java-HTTP-Server und Java-Servlet-Container.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter authentifizierter Angreifer kann mehrere Schwachstellen in Eclipse Jetty ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen oder einen HTTP-Cache-Poison-Angriff durchzuf\u00fchren.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Linux\n- MacOS X\n- UNIX\n- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2023-2359 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2023/wid-sec-w-2023-2359.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2023-2359 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2023-2359"
      },
      {
        "category": "external",
        "summary": "Amazon Linux Security Advisory ALAS-2024-2394 vom 2024-01-10",
        "url": "https://alas.aws.amazon.com/AL2/ALAS-2024-2394.html"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7099297 vom 2023-12-18",
        "url": "https://www.ibm.com/support/pages/node/7099297"
      },
      {
        "category": "external",
        "summary": "Amazon Linux Security Advisory ALAS-2024-2460 vom 2024-02-19",
        "url": "https://alas.aws.amazon.com/AL2/ALAS-2024-2460.html"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7108700 vom 2024-01-17",
        "url": "https://www.ibm.com/support/pages/node/7108700"
      },
      {
        "category": "external",
        "summary": "Eclipse Jetty Security Advisories vom 2023-09-14",
        "url": "https://www.eclipse.org/lists/jetty-announce/msg00180.html"
      },
      {
        "category": "external",
        "summary": "Debian Security Advisory DSA-5507 vom 2023-09-29",
        "url": "https://lists.debian.org/debian-security-announce/2023/msg00200.html"
      },
      {
        "category": "external",
        "summary": "Debian Security Advisory DLA-3592 vom 2023-09-30",
        "url": "https://lists.debian.org/debian-lts-announce/2023/09/msg00039.html"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2023:5441 vom 2023-10-04",
        "url": "https://access.redhat.com/errata/RHSA-2023:5441"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2023:5946 vom 2023-10-20",
        "url": "https://access.redhat.com/errata/RHSA-2023:5946"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7055552 vom 2023-10-20",
        "url": "https://www.ibm.com/support/pages/node/7055552"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2023:4210-1 vom 2023-10-26",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2023-October/016857.html"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2023:7247 vom 2023-11-16",
        "url": "https://access.redhat.com/errata/RHSA-2023:7247"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7076274 vom 2023-11-15",
        "url": "https://www.ibm.com/support/pages/node/7076274"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2024:0778 vom 2024-02-12",
        "url": "https://access.redhat.com/errata/RHSA-2024:0778"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7082766 vom 2023-11-28",
        "url": "https://www.ibm.com/support/pages/node/7082766"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7070757 vom 2023-11-29",
        "url": "https://www.ibm.com/support/pages/node/7070757"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2024:3354 vom 2024-05-24",
        "url": "https://access.redhat.com/errata/RHSA-2024:3354"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7156278 vom 2024-06-03",
        "url": "https://www.ibm.com/support/pages/node/7156278"
      },
      {
        "category": "external",
        "summary": "RedHat Security Advisory",
        "url": "https://access.redhat.com/errata/RHSA-2024:3919"
      }
    ],
    "source_lang": "en-US",
    "title": "Eclipse Jetty: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2024-06-13T22:00:00.000+00:00",
      "generator": {
        "date": "2024-06-14T08:08:57.793+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.3.0"
        }
      },
      "id": "WID-SEC-W-2023-2359",
      "initial_release_date": "2023-09-14T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2023-09-14T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2023-09-28T22:00:00.000+00:00",
          "number": "2",
          "summary": "Neue Updates von Debian aufgenommen"
        },
        {
          "date": "2023-10-01T22:00:00.000+00:00",
          "number": "3",
          "summary": "Neue Updates von Debian aufgenommen"
        },
        {
          "date": "2023-10-04T22:00:00.000+00:00",
          "number": "4",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2023-10-19T22:00:00.000+00:00",
          "number": "5",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2023-10-26T22:00:00.000+00:00",
          "number": "6",
          "summary": "Neue Updates von SUSE aufgenommen"
        },
        {
          "date": "2023-11-15T23:00:00.000+00:00",
          "number": "7",
          "summary": "Neue Updates von Red Hat und IBM aufgenommen"
        },
        {
          "date": "2023-11-27T23:00:00.000+00:00",
          "number": "8",
          "summary": "Neue Updates von IBM aufgenommen"
        },
        {
          "date": "2023-11-28T23:00:00.000+00:00",
          "number": "9",
          "summary": "Neue Updates von IBM aufgenommen"
        },
        {
          "date": "2023-12-18T23:00:00.000+00:00",
          "number": "10",
          "summary": "Neue Updates von IBM aufgenommen"
        },
        {
          "date": "2024-01-09T23:00:00.000+00:00",
          "number": "11",
          "summary": "Neue Updates von Amazon aufgenommen"
        },
        {
          "date": "2024-01-17T23:00:00.000+00:00",
          "number": "12",
          "summary": "Neue Updates von IBM aufgenommen"
        },
        {
          "date": "2024-02-11T23:00:00.000+00:00",
          "number": "13",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2024-02-19T23:00:00.000+00:00",
          "number": "14",
          "summary": "Neue Updates von Amazon aufgenommen"
        },
        {
          "date": "2024-05-23T22:00:00.000+00:00",
          "number": "15",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2024-06-03T22:00:00.000+00:00",
          "number": "16",
          "summary": "Neue Updates von IBM aufgenommen"
        },
        {
          "date": "2024-06-13T22:00:00.000+00:00",
          "number": "17",
          "summary": "Neue Updates von Red Hat aufgenommen"
        }
      ],
      "status": "final",
      "version": "17"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Amazon Linux 2",
            "product": {
              "name": "Amazon Linux 2",
              "product_id": "398363",
              "product_identification_helper": {
                "cpe": "cpe:/o:amazon:linux_2:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Amazon"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Debian Linux",
            "product": {
              "name": "Debian Linux",
              "product_id": "2951",
              "product_identification_helper": {
                "cpe": "cpe:/o:debian:debian_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Debian"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c9.4.52",
                "product": {
                  "name": "Eclipse Jetty \u003c9.4.52",
                  "product_id": "T029897",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:eclipse:jetty:9.4.52"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c10.0.16",
                "product": {
                  "name": "Eclipse Jetty \u003c10.0.16",
                  "product_id": "T029898",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:eclipse:jetty:10.0.16"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c11.0.16",
                "product": {
                  "name": "Eclipse Jetty \u003c11.0.16",
                  "product_id": "T029899",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:eclipse:jetty:11.0.16"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c12.0.1",
                "product": {
                  "name": "Eclipse Jetty \u003c12.0.1",
                  "product_id": "T029900",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:eclipse:jetty:12.0.1"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c12.0.0",
                "product": {
                  "name": "Eclipse Jetty \u003c12.0.0",
                  "product_id": "T029901",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:eclipse:jetty:12.0.0"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Jetty"
          }
        ],
        "category": "vendor",
        "name": "Eclipse"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "IBM Business Automation Workflow",
            "product": {
              "name": "IBM Business Automation Workflow",
              "product_id": "T019704",
              "product_identification_helper": {
                "cpe": "cpe:/a:ibm:business_automation_workflow:-"
              }
            }
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "11.7",
                "product": {
                  "name": "IBM InfoSphere Information Server 11.7",
                  "product_id": "444803",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:infosphere_information_server:11.7"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "InfoSphere Information Server"
          },
          {
            "category": "product_name",
            "name": "IBM Integration Bus",
            "product": {
              "name": "IBM Integration Bus",
              "product_id": "T011169",
              "product_identification_helper": {
                "cpe": "cpe:/a:ibm:integration_bus:-"
              }
            }
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "7.6.1",
                "product": {
                  "name": "IBM Maximo Asset Management 7.6.1",
                  "product_id": "389168",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:maximo_asset_management:7.6.1"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Maximo Asset Management"
          },
          {
            "category": "product_name",
            "name": "IBM Operational Decision Manager",
            "product": {
              "name": "IBM Operational Decision Manager",
              "product_id": "T005180",
              "product_identification_helper": {
                "cpe": "cpe:/a:ibm:operational_decision_manager:-"
              }
            }
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "7.5",
                "product": {
                  "name": "IBM QRadar SIEM 7.5",
                  "product_id": "T022954",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:qradar_siem:7.5"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "QRadar SIEM"
          }
        ],
        "category": "vendor",
        "name": "IBM"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux",
                "product": {
                  "name": "Red Hat Enterprise Linux",
                  "product_id": "67646",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:-"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux",
                "product": {
                  "name": "Red Hat Enterprise Linux",
                  "product_id": "T035142",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:-"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Enterprise Linux"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "SUSE Linux",
            "product": {
              "name": "SUSE Linux",
              "product_id": "T002207",
              "product_identification_helper": {
                "cpe": "cpe:/o:suse:suse_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-36479",
      "notes": [
        {
          "category": "description",
          "text": "Es besteht eine Schwachstelle in Eclipse Jetty. Dieser Fehler besteht in org.eclipse.jetty.servlets.CGI Servlet aufgrund einer unzureichenden Validierung der vom Benutzer bereitgestellten Eingaben, die es erlaubt, einen Befehl vor seiner Ausf\u00fchrung zu quoten. Ein entfernter Angreifer kann diese Schwachstelle zur Ausf\u00fchrung von beliebigem Code ausnutzen."
        }
      ],
      "product_status": {
        "known_affected": [
          "T022954",
          "2951",
          "T002207",
          "67646",
          "T011169",
          "444803",
          "T019704",
          "T005180",
          "389168",
          "398363",
          "T035142"
        ]
      },
      "release_date": "2023-09-14T22:00:00Z",
      "title": "CVE-2023-36479"
    },
    {
      "cve": "CVE-2023-40167",
      "notes": [
        {
          "category": "description",
          "text": "Es besteht eine Schwachstelle in Eclipse Jetty. Dieser Fehler besteht aufgrund einer unsachgem\u00e4\u00dfen Validierung von HTTP-Anfragen bei der Behandlung des \"+\"-Zeichens. Durch das Senden einer speziell gestalteten HTTP-Anfrage an den Server kann ein entfernter Angreifer diese Schwachstelle ausnutzen, um HTTP-Anfrage-Schmuggel durchzuf\u00fchren."
        }
      ],
      "product_status": {
        "known_affected": [
          "T022954",
          "2951",
          "T002207",
          "67646",
          "T011169",
          "444803",
          "T019704",
          "T029901",
          "T005180",
          "389168",
          "398363",
          "T035142"
        ]
      },
      "release_date": "2023-09-14T22:00:00Z",
      "title": "CVE-2023-40167"
    },
    {
      "cve": "CVE-2023-41900",
      "notes": [
        {
          "category": "description",
          "text": "Es besteht eine Schwachstelle in Eclipse Jetty. Dieser Fehler besteht in der Komponente OpenIdAuthenticator LoginServer aufgrund einer unzul\u00e4ssigen Autorisierung im Widerrufsprozess. Ein entfernter Angreifer kann diese Schwachstelle ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen."
        }
      ],
      "product_status": {
        "known_affected": [
          "T022954",
          "2951",
          "T002207",
          "67646",
          "T011169",
          "444803",
          "T019704",
          "T005180",
          "389168",
          "398363",
          "T035142"
        ]
      },
      "release_date": "2023-09-14T22:00:00Z",
      "title": "CVE-2023-41900"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.