Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2026:3631-1

Опубликовано: 17 авг. 2026
Источник: suse-cvrf

Описание

Security update for jetty-minimal

This update for jetty-minimal fixes the following issues:

  • CVE-2026-10050: ISO-8859-1 lossy encoding allows authentication bypass via character substitution (bsc#1272393).

Список пакетов

SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS
jetty-http-9.4.58-150200.3.43.1
jetty-io-9.4.58-150200.3.43.1
jetty-security-9.4.58-150200.3.43.1
jetty-server-9.4.58-150200.3.43.1
jetty-servlet-9.4.58-150200.3.43.1
jetty-util-9.4.58-150200.3.43.1
jetty-util-ajax-9.4.58-150200.3.43.1
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS
jetty-http-9.4.58-150200.3.43.1
jetty-io-9.4.58-150200.3.43.1
jetty-security-9.4.58-150200.3.43.1
jetty-server-9.4.58-150200.3.43.1
jetty-servlet-9.4.58-150200.3.43.1
jetty-util-9.4.58-150200.3.43.1
jetty-util-ajax-9.4.58-150200.3.43.1
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS
jetty-http-9.4.58-150200.3.43.1
jetty-io-9.4.58-150200.3.43.1
jetty-security-9.4.58-150200.3.43.1
jetty-server-9.4.58-150200.3.43.1
jetty-servlet-9.4.58-150200.3.43.1
jetty-util-9.4.58-150200.3.43.1
jetty-util-ajax-9.4.58-150200.3.43.1
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS
jetty-http-9.4.58-150200.3.43.1
jetty-io-9.4.58-150200.3.43.1
jetty-security-9.4.58-150200.3.43.1
jetty-server-9.4.58-150200.3.43.1
jetty-servlet-9.4.58-150200.3.43.1
jetty-util-9.4.58-150200.3.43.1
jetty-util-ajax-9.4.58-150200.3.43.1
SUSE Linux Enterprise Module for Development Tools 15 SP7
jetty-http-9.4.58-150200.3.43.1
jetty-io-9.4.58-150200.3.43.1
jetty-security-9.4.58-150200.3.43.1
jetty-server-9.4.58-150200.3.43.1
jetty-servlet-9.4.58-150200.3.43.1
jetty-util-9.4.58-150200.3.43.1
jetty-util-ajax-9.4.58-150200.3.43.1
SUSE Linux Enterprise Module for Package Hub 15 SP7
jetty-continuation-9.4.58-150200.3.43.1
SUSE Linux Enterprise Server 15 SP4-LTSS
jetty-http-9.4.58-150200.3.43.1
jetty-io-9.4.58-150200.3.43.1
jetty-security-9.4.58-150200.3.43.1
jetty-server-9.4.58-150200.3.43.1
jetty-servlet-9.4.58-150200.3.43.1
jetty-util-9.4.58-150200.3.43.1
jetty-util-ajax-9.4.58-150200.3.43.1
SUSE Linux Enterprise Server 15 SP5-LTSS
jetty-http-9.4.58-150200.3.43.1
jetty-io-9.4.58-150200.3.43.1
jetty-security-9.4.58-150200.3.43.1
jetty-server-9.4.58-150200.3.43.1
jetty-servlet-9.4.58-150200.3.43.1
jetty-util-9.4.58-150200.3.43.1
jetty-util-ajax-9.4.58-150200.3.43.1
SUSE Linux Enterprise Server 15 SP6-LTSS
jetty-http-9.4.58-150200.3.43.1
jetty-io-9.4.58-150200.3.43.1
jetty-security-9.4.58-150200.3.43.1
jetty-server-9.4.58-150200.3.43.1
jetty-servlet-9.4.58-150200.3.43.1
jetty-util-9.4.58-150200.3.43.1
jetty-util-ajax-9.4.58-150200.3.43.1
SUSE Linux Enterprise Server for SAP Applications 15 SP4
jetty-http-9.4.58-150200.3.43.1
jetty-io-9.4.58-150200.3.43.1
jetty-security-9.4.58-150200.3.43.1
jetty-server-9.4.58-150200.3.43.1
jetty-servlet-9.4.58-150200.3.43.1
jetty-util-9.4.58-150200.3.43.1
jetty-util-ajax-9.4.58-150200.3.43.1
SUSE Linux Enterprise Server for SAP Applications 15 SP5
jetty-http-9.4.58-150200.3.43.1
jetty-io-9.4.58-150200.3.43.1
jetty-security-9.4.58-150200.3.43.1
jetty-server-9.4.58-150200.3.43.1
jetty-servlet-9.4.58-150200.3.43.1
jetty-util-9.4.58-150200.3.43.1
jetty-util-ajax-9.4.58-150200.3.43.1
SUSE Linux Enterprise Server for SAP Applications 15 SP6
jetty-http-9.4.58-150200.3.43.1
jetty-io-9.4.58-150200.3.43.1
jetty-security-9.4.58-150200.3.43.1
jetty-server-9.4.58-150200.3.43.1
jetty-servlet-9.4.58-150200.3.43.1
jetty-util-9.4.58-150200.3.43.1
jetty-util-ajax-9.4.58-150200.3.43.1

Ссылки

Описание

In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes. This was done because the initial specification for HTTP did not specify explicitly a charset, and it was assumed to be ISO-8859-1 for historical reasons. If the password contains characters that cannot be represented in ISO-8859-1, they are silently replaced by `?`. This happens with passwords that contain Chinese, Cyrillic or Greek characters, for example: `αβ123` converts to `??123`. An attacker can send a request with a digest `Authorization` header crafted with a password made of only `?` characters; the server would match any password of the same length that contains non-ISO-8859-1 characters. Recent HTTP Digest [RFC-7616](https://datatracker.ietf.org/doc/html/rfc7616) supports a `charset` parameters that defaults to UTF-8 that allows for correct encoding/decoding of passwords.

Затронутые продукты
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:jetty-http-9.4.58-150200.3.43.1
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:jetty-io-9.4.58-150200.3.43.1
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:jetty-security-9.4.58-150200.3.43.1
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:jetty-server-9.4.58-150200.3.43.1
Ссылки