Описание
In Eclipse Jetty, a first HTTP/1.1 request with trailers causes the server to retain the trailers in subsequent requests performed over the same connection.
Subsequent request that do not have trailers report the trailers of the first request.
Subsequent request that do have trailers report the union of trailers of the first request and the current request.
A flaw was found in Eclipse Jetty. This vulnerability allows a remote attacker to cause the server to retain HTTP/1.1 request trailers from a prior connection. Consequently, subsequent requests made over the same connection may unintentionally disclose information by reporting the previously retained trailers, or a combination of previous and current request trailers.
Отчет
Moderate: This information disclosure flaw in Eclipse Jetty allows HTTP/1.1 trailers from a previous request to be retained and subsequently exposed to other requests sharing the same connection. This could lead to unintended disclosure of sensitive information in Red Hat products utilizing Jetty, such as Red Hat AMQ and Enterprise Application Platform, particularly when connection reuse is active and trailers contain confidential data. The confidentiality impact is considered low.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| OpenShift Developer Tools and Services | jenkins | Affected | ||
| OpenShift Developer Tools and Services | ocp-tools-4/jenkins-rhel8 | Affected | ||
| OpenShift Developer Tools and Services | ocp-tools-4/jenkins-rhel9 | Affected | ||
| Red Hat AMQ Broker 7 | jetty-server | Affected | ||
| Red Hat build of Apache Camel for Spring Boot 4 | jetty-server | Affected | ||
| Red Hat build of Apache Camel - HawtIO 4 | jetty-server | Affected | ||
| Red Hat build of Apicurio Registry 3 | jetty-server | Not affected | ||
| Red Hat build of Debezium 3 | jetty-server | Affected | ||
| Red Hat Data Grid 8 | jetty-server | Affected | ||
| Red Hat Enterprise Linux 7 | maven-site-plugin | Not affected |
Показывать по
Дополнительная информация
Статус:
EPSS
5.3 Medium
CVSS3
Связанные уязвимости
In Eclipse Jetty, a first HTTP/1.1 request with trailers causes the server to retain the trailers in subsequent requests performed over the same connection. Subsequent request that do not have trailers report the trailers of the first request. Subsequent request that do have trailers report the union of trailers of the first request and the current request.
In Eclipse Jetty, a first HTTP/1.1 request with trailers causes the server to retain the trailers in subsequent requests performed over the same connection. Subsequent request that do not have trailers report the trailers of the first request. Subsequent request that do have trailers report the union of trailers of the first request and the current request.
In Eclipse Jetty, a first HTTP/1.1 request with trailers causes the se ...
Eclipse Jetty: Cross-Request Leakage for trailers on HTTP/1.1 keep-alive connections
EPSS
5.3 Medium
CVSS3