ALT-PU-2024-16022: package jetty update to version 9.4.56-alt1
Описание
This update upgrades jetty to version 9.4.56-alt1.
Устраненные уязвимости29
Ссылки18
GHSA-3gh6-v5v9-6v9j
https://github.com/advisories/GHSA-3gh6-v5v9-6v9jGHSA-cj7v-27pg-wf7q
https://github.com/advisories/GHSA-cj7v-27pg-wf7qGHSA-g8m5-722r-8whq
https://github.com/advisories/GHSA-g8m5-722r-8whqGHSA-gwcr-j4wh-j3cq
https://github.com/advisories/GHSA-gwcr-j4wh-j3cqGHSA-hmr7-m48g-48f6
https://github.com/advisories/GHSA-hmr7-m48g-48f6GHSA-j26w-f9rq-mr2q
https://github.com/advisories/GHSA-j26w-f9rq-mr2qGHSA-m425-mq94-257g
https://github.com/advisories/GHSA-m425-mq94-257gGHSA-m6cp-vxjx-65j6
https://github.com/advisories/GHSA-m6cp-vxjx-65j6GHSA-p26g-97m4-6q7c
https://github.com/advisories/GHSA-p26g-97m4-6q7cGHSA-pwh8-58vv-vw48
https://github.com/advisories/GHSA-pwh8-58vv-vw48GHSA-qppj-fm5r-hxr3
https://github.com/advisories/GHSA-qppj-fm5r-hxr3GHSA-qw69-rqj8-6qw8
https://github.com/advisories/GHSA-qw69-rqj8-6qw8GHSA-rggv-cv7r-mw98
https://github.com/advisories/GHSA-rggv-cv7r-mw98GHSA-vjv5-gp2w-65vm
https://github.com/advisories/GHSA-vjv5-gp2w-65vmGHSA-wgh7-54f2-x98r
https://github.com/advisories/GHSA-wgh7-54f2-x98rGHSA-wgmr-mf83-7x4j
https://github.com/advisories/GHSA-wgmr-mf83-7x4jGHSA-xpw8-rcwv-8f8p
https://github.com/advisories/GHSA-xpw8-rcwv-8f8pСвязанные уязвимости
ALT-PU-2024-16002: package `jetty` update to version 9.4.56-alt1
For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory. For example a request to `/concat?/%2557EB-INF/web.xml` can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.
For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory. For example a request to `/concat?/%2557EB-INF/web.xml` can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.
For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory. For example a request to `/concat?/%2557EB-INF/web.xml` can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.
For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is poss ...