<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">
<html lang="en" style="--code-editor-font: GitLab Mono, JetBrains Mono, Menlo, DejaVu Sans Mono, Liberation Mono, Consolas, Ubuntu Mono, Courier New, andale mono, lucida console, monospace;">
<head>
<meta content="text/html; charset=US-ASCII" http-equiv="Content-Type">
<title>
GitLab
</title>
<style data-premailer="ignore" type="text/css">
a { color: #1068bf; }
</style>
<style>img {
max-width: 100%; height: auto;
}
body {
font-size: 0.875rem;
}
body {
-webkit-text-shadow: rgba(255,255,255,0.01) 0 0 1px;
}
body {
font-family: "GitLab Sans", -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Noto Sans", Ubuntu, Cantarell, "Helvetica Neue", sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol", "Noto Color Emoji"; font-size: inherit;
}
</style>
</head>
<body style='font-size: inherit; -webkit-text-shadow: rgba(255,255,255,0.01) 0 0 1px; font-family: "GitLab Sans", -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Noto Sans", Ubuntu, Cantarell, "Helvetica Neue", sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol", "Noto Color Emoji";'>
<div class="content">
<h3 style="margin-top: 20px; margin-bottom: 10px;">
Markus Koschany pushed to branch bullseye at <a href="https://salsa.debian.org/java-team/jetty9">Debian Java Maintainers / jetty9</a>
</h3>
<h4 style="margin-top: 10px; margin-bottom: 10px;">
Commits:
</h4>
<ul>
<li>
<strong style="font-weight: bold;"><a href="https://salsa.debian.org/java-team/jetty9/-/commit/8ff9b29936f217e09be1b9573aedd7f5ea37bd2b">8ff9b299</a></strong>
<div>
<span> by Emmanuel Bourg </span> <i> at 2021-10-18T10:26:37+02:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #333238; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>New upstream version 9.4.40</pre>
</li>
<li>
<strong style="font-weight: bold;"><a href="https://salsa.debian.org/java-team/jetty9/-/commit/348c44a3ab9f61b82521b5fdd39ce890cb55b8a1">348c44a3</a></strong>
<div>
<span> by Emmanuel Bourg </span> <i> at 2021-10-18T10:27:32+02:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #333238; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>New upstream version 9.4.41</pre>
</li>
<li>
<strong style="font-weight: bold;"><a href="https://salsa.debian.org/java-team/jetty9/-/commit/d63be05d34913e173ea42debe6c48f577eb0e14e">d63be05d</a></strong>
<div>
<span> by Emmanuel Bourg </span> <i> at 2021-10-18T10:28:25+02:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #333238; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>New upstream version 9.4.42</pre>
</li>
<li>
<strong style="font-weight: bold;"><a href="https://salsa.debian.org/java-team/jetty9/-/commit/2812d7f11b1931e7928334615da7a50d8b684606">2812d7f1</a></strong>
<div>
<span> by Emmanuel Bourg </span> <i> at 2021-10-18T10:29:06+02:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #333238; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>New upstream version 9.4.43</pre>
</li>
<li>
<strong style="font-weight: bold;"><a href="https://salsa.debian.org/java-team/jetty9/-/commit/ff45b723813e055df4b0d79bc6e004f2ca174046">ff45b723</a></strong>
<div>
<span> by Emmanuel Bourg </span> <i> at 2021-10-18T10:29:34+02:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #333238; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>New upstream version 9.4.44</pre>
</li>
<li>
<strong style="font-weight: bold;"><a href="https://salsa.debian.org/java-team/jetty9/-/commit/68c3a969766530b2216eb3f1a73587bd8dd7d24f">68c3a969</a></strong>
<div>
<span> by Markus Koschany </span> <i> at 2022-02-11T10:53:57+01:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #333238; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>New upstream version 9.4.45</pre>
</li>
<li>
<strong style="font-weight: bold;"><a href="https://salsa.debian.org/java-team/jetty9/-/commit/e6071ff4edae49d02c8291035ec3d6ba2b39f96a">e6071ff4</a></strong>
<div>
<span> by Markus Koschany </span> <i> at 2022-02-11T11:19:54+01:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #333238; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>New upstream version 9.4.45</pre>
</li>
<li>
<strong style="font-weight: bold;"><a href="https://salsa.debian.org/java-team/jetty9/-/commit/ace796c18e5102c8eda8eb1613a1f0dd394c70f3">ace796c1</a></strong>
<div>
<span> by Emmanuel Bourg </span> <i> at 2022-05-02T18:34:10+02:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #333238; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>New upstream version 9.4.46</pre>
</li>
<li>
<strong style="font-weight: bold;"><a href="https://salsa.debian.org/java-team/jetty9/-/commit/006797f476e8d92942e5715f6a3a86da220734c2">006797f4</a></strong>
<div>
<span> by Markus Koschany </span> <i> at 2022-07-18T13:25:59+02:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #333238; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>New upstream version 9.4.48</pre>
</li>
<li>
<strong style="font-weight: bold;"><a href="https://salsa.debian.org/java-team/jetty9/-/commit/b614d144ddf279c1b169c7a5532de2bb28b460c3">b614d144</a></strong>
<div>
<span> by Markus Koschany </span> <i> at 2022-09-22T23:40:01+02:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #333238; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>New upstream version 9.4.49</pre>
</li>
<li>
<strong style="font-weight: bold;"><a href="https://salsa.debian.org/java-team/jetty9/-/commit/a6be8216a052ede0851ff883b8dbd23b09056534">a6be8216</a></strong>
<div>
<span> by Emmanuel Bourg </span> <i> at 2022-11-27T22:36:01+01:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #333238; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>New upstream version 9.4.50</pre>
</li>
<li>
<strong style="font-weight: bold;"><a href="https://salsa.debian.org/java-team/jetty9/-/commit/038b6bc7fdcb5ae3cbb7715a77a560e2e9fa5baa">038b6bc7</a></strong>
<div>
<span> by Markus Koschany </span> <i> at 2023-10-30T17:31:26+01:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #333238; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>Import Debian changes 9.4.50-4+deb11u1
jetty9 (9.4.50-4+deb11u1) bullseye-security; urgency=high
.
* Team upload.
* Backport Jetty 9 version from Bookworm.
* Fix CVE-2023-36478 and CVE-2023-44487:
Two remotely exploitable security vulnerabilities were discovered in Jetty
9, a Java based web server and servlet engine. The HTTP/2 protocol
implementation did not sufficiently verify if HPACK header values exceed
their size limit. Furthermore the HTTP/2 protocol allowed a denial of
service (server resource consumption) because request cancellation can
reset many streams quickly. This problem is also known as Rapid Reset
Attack.
.
jetty9 (9.4.50-4+deb12u1) bookworm-security; urgency=high
.
* Team upload.
* The org.eclipse.jetty.servlets.CGI has been deprecated. It is potentially
unsafe to use it. The upstream developers of Jetty recommend to use Fast CGI
instead. See also CVE-2023-36479.
* Fix CVE-2023-26048:
Jetty is a java based web server and servlet engine. In affected versions
servlets with multipart support (e.g. annotated with `@MultipartConfig`)
that call `HttpServletRequest.getParameter()` or
`HttpServletRequest.getParts()` may cause `OutOfMemoryError` when the
client sends a multipart request with a part that has a name but no
filename and very large content. This happens even with the default
settings of `fileSizeThreshold=0` which should stream the whole part
content to disk.
* Fix CVE-2023-26049:
Nonstandard cookie parsing in Jetty may allow an attacker to smuggle
cookies within other cookies, or otherwise perform unintended behavior by
tampering with the cookie parsing mechanism.
* Fix CVE-2023-40167:
Prior to this version Jetty accepted the `+` character proceeding the
content-length value in a HTTP/1 header field. This is more permissive than
allowed by the RFC and other servers routinely reject such requests with
400 responses. There is no known exploit scenario, but it is conceivable
that request smuggling could result if jetty is used in combination with a
server that does not close the connection after sending such a 400
response.
* CVE-2023-36479:
Users of the CgiServlet with a very specific command structure may have the
wrong command executed. If a user sends a request to a
org.eclipse.jetty.servlets.CGI Servlet for a binary with a space in its
name, the servlet will escape the command by wrapping it in quotation
marks. This wrapped command, plus an optional command prefix, will then be
executed through a call to Runtime.exec. If the original binary name
provided by the user contains a quotation mark followed by a space, the
resulting command line will contain multiple tokens instead of one.
* Fix CVE-2023-41900:
Jetty is vulnerable to weak authentication. If a Jetty
`OpenIdAuthenticator` uses the optional nested `LoginService`, and that
`LoginService` decides to revoke an already authenticated user, then the
current request will still treat the user as authenticated. The
authentication is then cleared from the session and subsequent requests
will not be treated as authenticated. So a request on a previously
authenticated session could be allowed to bypass authentication after it
had been rejected by the `LoginService`. This impacts usages of the
jetty-openid which have configured a nested `LoginService` and where that
`LoginService` is capable of rejecting previously authenticated users.
.
jetty9 (9.4.50-4) unstable; urgency=medium
.
* Team upload.
* Revert the switch to libtomcat10-java. For now Jetty 9 only works correctly
with libtomcat9-java. (Closes: #1036798)
.
jetty9 (9.4.50-3) unstable; urgency=medium
.
* Team upload.
* Depend on libtomcat10-java instead of libtomcat9-java.
* Add tomcat10-migration.patch.
* Ignore jetty-jaspi module because it does not work with Tomcat 10 yet.
.
jetty9 (9.4.50-2) unstable; urgency=medium
.
* Depend on libeclipse-jdt-core-java instead of libecj-java
* Standards-Version updated to 4.6.2
.
jetty9 (9.4.50-1) unstable; urgency=medium
.
* New upstream release
- Refreshed the patches
.
jetty9 (9.4.49-1) unstable; urgency=medium
.
* Team upload.
* New upstream version 9.4.49.
.
jetty9 (9.4.48-1) unstable; urgency=high
.
* Team upload.
* New upstream version 9.4.48.
- Fix CVE-2022-2048 and CVE-2022-2047.
.
jetty9 (9.4.46-1) unstable; urgency=medium
.
* New upstream release
- Refreshed the patches
.
jetty9 (9.4.45-1) unstable; urgency=medium
.
* Team upload.
* New upstream version 9.4.45.
* Remove haproxy binary file from the sources.
.
jetty9 (9.4.44-4) unstable; urgency=medium
.
* Team upload.
* Add servlet-api.patch and correct the API version in jetty-home/pom.xml.
This used to work because libservlet3.1-java was pulled in as a transitive
dependency. (Closes: #1002274)
.
jetty9 (9.4.44-3) unstable; urgency=medium
.
* Team upload.
* Ignore junit-bom artifact of scope import.
The junit-bom dependency caused several FTBFS because of
reverse-dependencies that did not depend on junit5.
.
jetty9 (9.4.44-2) unstable; urgency=medium
.
* Team upload.
* Update README.Debian and clarify how to override systemd security features.
(Closes: #994440)
* Replace deprecated configuration options in start.ini.
Thanks to Martin van Es for the report. (Closes: #994441)
.
jetty9 (9.4.44-1) unstable; urgency=medium
.
* New upstream release
- Refreshed the patches
- Updated the Maven rules
* Depend on libservlet-api-java instead of libservlet3.1-java
* No longer remove the jetty user/group when purging the package
* Standards-Version updated to 4.6.0.1
* Switch to debhelper level 13
</pre>
</li>
</ul>
<h4 style="margin-top: 10px; margin-bottom: 10px;">
30 changed files:
</h4>
<ul>
<li class="file-stats">
<a href="#5efbb8957a5289dc9c5a154f21fa31102f33b627">
.github/ISSUE_TEMPLATE/issue-template.md
</a>
</li>
<li class="file-stats">
<a href="#091aff741808a09242f252264b14f4a9adaa5305">
.github/dependabot.yml
</a>
</li>
<li class="file-stats">
<a href="#0c2c5c506cef0ed2d3ad2b7e45e97980b66f5520">
Jenkinsfile
</a>
</li>
<li class="file-stats">
<a href="#9266624b881ae43f2b64a389484ea9e0754afaa6">
VERSION.txt
</a>
</li>
<li class="file-stats">
<a href="#5518a3eefb8da4464495be63e858ce431a118e2e">
aggregates/jetty-all-compact3/pom.xml
</a>
</li>
<li class="file-stats">
<a href="#600b389cfdc10e2c613506b12e441c5622bee2cd">
aggregates/jetty-all/pom.xml
</a>
</li>
<li class="file-stats">
<a href="#672ce6dcd05a2372c389083e70f7bbf32a6a79fa">
apache-jsp/pom.xml
</a>
</li>
<li class="file-stats">
<a href="#7364d1b57a992736082cc85b6f74f95db514bbb0">
apache-jsp/src/main/java/org/eclipse/jetty/apache/jsp/JettyJasperInitializer.java
</a>
</li>
<li class="file-stats">
<a href="#7b3dec77377924bae2ed79894e2f59cbd188d54f">
apache-jsp/src/main/java/org/eclipse/jetty/apache/jsp/JettyTldPreScanned.java
</a>
</li>
<li class="file-stats">
<a href="#27dd5ee390608d9097b196bf4ae76e9598197c41">
apache-jsp/src/main/java/org/eclipse/jetty/apache/jsp/JuliLog.java
</a>
</li>
<li class="file-stats">
<a href="#5c387724b6eec3f702b96e8a210e728d83c0f87d">
apache-jsp/src/main/java/org/eclipse/jetty/jsp/JettyJspServlet.java
</a>
</li>
<li class="file-stats">
<a href="#40a5a5a540178036c43b77446315942bee73c3a3">
apache-jsp/src/test/java/org/eclipse/jetty/jsp/TestJettyJspServlet.java
</a>
</li>
<li class="file-stats">
<a href="#d56c745ad52c4954d0444bf706239666a555f039">
apache-jsp/src/test/java/org/eclipse/jetty/jsp/TestJettyTldPreScanned.java
</a>
</li>
<li class="file-stats">
<a href="#23327a83db87ba2810ea6a55a8b4002cc56e868e">
apache-jsp/src/test/java/org/eclipse/jetty/jsp/TestJspFileNameToClass.java
</a>
</li>
<li class="file-stats">
<a href="#f62e58e9e063cbb529ed9cfa33a2b1960f9eef22">
apache-jstl/pom.xml
</a>
</li>
<li class="file-stats">
<a href="#ea3f9d0478ec2e93d0e6036cb07123ca8e6b5b5f">
apache-jstl/src/test/java/org/eclipse/jetty/jstl/JspConfig.java
</a>
</li>
<li class="file-stats">
<a href="#a25731afe2aec3384e3997b21bd40cb23bb81da2">
apache-jstl/src/test/java/org/eclipse/jetty/jstl/JspIncludeTest.java
</a>
</li>
<li class="file-stats">
<a href="#e8ebdb5cbf9cca1b956dd50568f1c318e42ed970">
apache-jstl/src/test/java/org/eclipse/jetty/jstl/JstlTest.java
</a>
</li>
<li class="file-stats">
<a href="#4503ee7352b84ee2b557406dfa13a3f7b5095fab">
build-resources/pom.xml
</a>
</li>
<li class="file-stats">
<a href="#f168b81935360ddcf2dd0f2d4b98b8603829060f">
debian/README.Debian
</a>
</li>
<li class="file-stats">
<a href="#9c96da0e9f91d7d8937b69b524702c106258f0d1">
debian/changelog
</a>
</li>
<li class="file-stats">
<a href="#58ef006ab62b83b4bec5d81fe5b32c3b4c2d1cc2">
debian/control
</a>
</li>
<li class="file-stats">
<a href="#adb7f75f79e3bb85eb62912a2904c5d24af878fb">
debian/copyright
</a>
</li>
<li class="file-stats">
<a href="#6c48a7077d304bcc32df79f82ead565c11d676ef">
debian/jetty9.dirs
</a>
</li>
<li class="file-stats">
<a href="#ba7fdc642699c119c5de4bf571f75ccc365c7085">
debian/jetty9.links
</a>
</li>
<li class="file-stats">
<a href="#343351998c607fdb4176707bd12b52784b62fc16">
debian/jetty9.postrm
</a>
</li>
<li class="file-stats">
<a href="#26121dc92cd4cd9822d2e9e2b619b799bf9a51f4">
debian/maven.ignoreRules
</a>
</li>
<li class="file-stats">
<a href="#58530b38acb0fa3a65612c676abaea46c4a3f2f3">
debian/maven.rules
</a>
</li>
<li class="file-stats">
<a href="#ba46c7b266dcbc476405214026111afc2a81edfe">
debian/patches/01-maven-bundle-plugin-version.patch
</a>
</li>
<li class="file-stats">
<a href="#21dd73eac9fa54aeb62971c88ffa717f90933fab">
debian/patches/02-import-alpn-api.patch
</a>
</li>
</ul>
<h5 style="margin-top: 10px; margin-bottom: 10px; font-size: 0.875rem;">
The diff was not included because it is too large.
</h5>
</div>
<div class="footer" style="margin-top: 10px;">
<p style="font-size: small; color: #737278;">
—
<br>
<a href="https://salsa.debian.org/java-team/jetty9/-/compare/8648cca8e0b426be8e0381e8e1204dd93cfbb52a...038b6bc7fdcb5ae3cbb7715a77a560e2e9fa5baa">View it on GitLab</a>.
<br>
You're receiving this email because of your account on <a target="_blank" rel="noopener noreferrer" href="https://salsa.debian.org">salsa.debian.org</a>. <a href="https://salsa.debian.org/-/profile/notifications" target="_blank" rel="noopener noreferrer" class="mng-notif-link">Manage all notifications</a> · <a href="https://salsa.debian.org/help" target="_blank" rel="noopener noreferrer" class="help-link">Help</a>
</p>
</div>
</body>
</html>