[Git][security-tracker-team/security-tracker][master] Add new batch of jetty issues

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
0473f0e8 by Salvatore Bonaccorso at 2026-10-16T07:09:49+02:00
Add new batch of jetty issues

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -96,7 +96,9 @@ CVE-2026-78851 (Directory Traversal vulnerability in Grav CMS 2.0.3 through 2.0.
 CVE-2026-78850 (An issue in Matomo v.5.11.2 allows a remote attacker to obtain sensiti ...)
 	- matomo <unfixed>
 CVE-2026-77711 (When Jetty's `HttpClient` make a request to a server through a forward ...)
-	TODO: check
+	- jetty12 12.0.39-1
+	- jetty9 <unfixed>
+	NOTE: https://github.com/jetty/jetty.project/security/advisories/GHSA-r2c5-3p8g-wpvw
 CVE-2026-77470 (Lychee is a free, open-source photo-management tool. Prior to 7.7.1, t ...)
 	NOT-FOR-US: Lychee
 CVE-2026-77468 (Lychee is a free, open-source photo-management tool. Prior to 7.7.0, G ...)
@@ -108,9 +110,14 @@ CVE-2026-77466 (Lychee is a free, open-source photo-management tool. Prior to 7.
 CVE-2026-77460 (EspoCRM is an open source customer relationship management application ...)
 	NOT-FOR-US: EspoCRM
 CVE-2026-76184 (In Eclipse Jetty, HttpClient may receive a redirect of the form:    `` ...)
-	TODO: check
+	- jetty12 12.0.39-1
+	- jetty9 <unfixed>
+	NOTE: https://github.com/jetty/jetty.project/security/advisories/GHSA-qfr2-43g5-g768
 CVE-2026-76182 (In Eclipse Jetty, `TryPathsHandler` and `TryFilesFilter` can be config ...)
-	TODO: check
+	- jetty12 12.0.39-1
+	- jetty9 <unfixed>
+	NOTE: https://github.com/jetty/jetty.project/security/advisories/GHSA-4hxv-32vm-5h2m
+	TODO: check if tracking correct, issue in multiple jetty components
 CVE-2026-75559 (The smartphone application "Vehicle Inspection Certificate Viewer" con ...)
 	NOT-FOR-US: Vehicle Inspection Certificate Viewer
 CVE-2026-75505 (EspoCRM is an open source customer relationship management application ...)
@@ -279,7 +286,9 @@ CVE-2026-24715 (An observable timing discrepancy vulnerability has been reported
 CVE-2026-22896 (A cross-site scripting (XSS) vulnerability has been reported to affect ...)
 	NOT-FOR-US: QNAP
 CVE-2026-19864 (Eclipse Jetty's `SessionAuthentication` retains authentication credent ...)
-	TODO: check
+	- jetty12 12.0.39-1
+	- jetty9 <unfixed>
+	NOTE: https://github.com/jetty/jetty.project/security/advisories/GHSA-q6wx-j9wr-fj7f
 CVE-2026-19863 (An unauthenticated client may access certain protected resources when  ...)
 	NOT-FOR-US: EtheriumAuthenticator
 CVE-2026-19377 (Improper certificate validation in the tunnel handshake in Cato Client ...)
@@ -289,7 +298,10 @@ CVE-2026-18662 (In Eclipse Jetty, across various versions of `jetty-security`, a
 CVE-2026-18661 (In Eclipse Jetty, across various versions of `jetty-annotations`, and  ...)
 	TODO: check
 CVE-2026-18660 (In Eclipse Jetty, across various versions of `jetty-server`, and `jett ...)
-	TODO: check
+	- jetty12 12.0.39-1
+	- jetty9 <unfixed>
+	NOTE: https://github.com/jetty/jetty.project/security/advisories/GHSA-7wfj-j486-mxrf
+	TODO: check details if affects src:jetty* or only external components
 CVE-2026-18659 (In Eclipse Jetty, across various versions of `jetty-security`, and `je ...)
 	TODO: check
 CVE-2026-17525 (Incomplete cleanup vulnerability in ABB My Control System.  This issue ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/0473f0e81151b9f73856a62a16ec98e54d5719ff

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/0473f0e81151b9f73856a62a16ec98e54d5719ff
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261016/955dbffe/attachment.htm>