[Git][security-tracker-team/security-tracker][master] new jetty issues

[Moritz Muehlenhoff (@jmm)]

Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
d6e44583 by Moritz Muehlenhoff at 2023-10-11T13:02:06+02:00
new jetty issues

- - - - -


2 changed files:

- data/CVE/list
- data/dsa-needed.txt


Changes:

=====================================
data/CVE/list
=====================================
@@ -451,7 +451,9 @@ CVE-2023-36548 (A improper neutralization of special elements used in an os comm
 CVE-2023-36547 (A improper neutralization of special elements used in an os command (' ...)
 	NOT-FOR-US: Fortinet
 CVE-2023-36478 (Eclipse Jetty provides a web server and servlet container. In versions ...)
-	TODO: check
+	- jetty9 9.4.53-1
+	NOTE: https://github.com/eclipse/jetty.project/security/advisories/GHSA-wgh7-54f2-x98r
+	NOTE: https://github.com/eclipse/jetty.project/pull/9634
 CVE-2023-36438 (Windows TCP/IP Information Disclosure Vulnerability)
 	NOT-FOR-US: Microsoft
 CVE-2023-36436 (Windows MSHTML Platform Remote Code Execution Vulnerability)
@@ -535,6 +537,7 @@ CVE-2023-44487 (The HTTP/2 protocol allows a denial of service (server resource
 	- haproxy 1.8.13-1
 	- nginx 1.24.0-2 (unimportant; bug #1053770)
 	- nghttp2 <unfixed> (bug #1053769)
+	- jetty9 9.4.53-1
 	NOTE: Tomcat: https://github.com/apache/tomcat/commit/76bb4bfbfeae827dce896f650655bbf6e251ed49 (10.1.x)
 	NOTE: Tomcat: https://github.com/apache/tomcat/commit/6d1a9fd6642387969e4410b9989c85856b74917a (9.0.x)
 	NOTE: ATS: https://lists.apache.org/thread/5py8h42mxfsn8l1wy6o41xwhsjlsd87q
@@ -548,6 +551,8 @@ CVE-2023-44487 (The HTTP/2 protocol allows a denial of service (server resource
 	NOTE: nghttp2: https://github.com/nghttp2/nghttp2/pull/1961
 	NOTE: nghttp2: https://github.com/nghttp2/nghttp2/security/advisories/GHSA-vx74-f528-fxqg
 	NOTE: nghttp2: https://github.com/nghttp2/nghttp2/commit/72b4af6143681f528f1d237b21a9a7aee1738832
+	NOTE: jetty9: https://github.com/eclipse/jetty.project/issues/10679
+	NOTE: jetty9: https://github.com/eclipse/jetty.project/releases/tag/jetty-9.4.53.v20231009
 	NOTE: https://www.openwall.com/lists/oss-security/2023/10/10/6
 	NOTE: https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/
 	NOTE: Go uses CVE-2023-39325 to track this


=====================================
data/dsa-needed.txt
=====================================
@@ -25,6 +25,8 @@ gpac/oldstable (jmm)
 --
 gst-plugins-bad1.0 (carnil)
 --
+jetty9
+--
 libcue (jmm)
 --
 libreswan (jmm)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/d6e445839647b9218fe7cb32a44f536d03a6796e

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/d6e445839647b9218fe7cb32a44f536d03a6796e
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20231011/3f8ea409/attachment.htm>