[Git][security-tracker-team/security-tracker][master] jetty updates

[Moritz Muehlenhoff (@jmm)]

Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
107cf7ad by Moritz Muehlenhoff at 2026-09-29T11:35:42+02:00
jetty updates

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -29820,10 +29820,9 @@ CVE-2026-19614 (The API is prone to XML external entity (XXE) injection. By defa
 	NOTE: https://www.thalesgroup.com/en/search/cybersecurity/cybersecurity-services/cve-2026-19614
 	TODO: check details as reference not accessible
 CVE-2026-19203 (A client may issue specially crafted HTTP/1.1 chunked requests to a Je ...)
-	- jetty12 <undetermined>
-	- jetty9 <undetermined>
+	- jetty12 12.0.39-1
+	- jetty9 <unfixed>
 	NOTE: https://github.com/jetty/jetty.project/security/advisories/GHSA-xc35-c22g-239h
-	TODO: check, GHSA reference not yet public
 CVE-2026-18851 (Missing authorization in Ivanti Endpoint Manager Mobile before version ...)
 	NOT-FOR-US: Ivanti
 CVE-2026-18021 (The The Beaver Builder Page Builder \u2013 Drag and Drop Website Build ...)
@@ -29857,10 +29856,9 @@ CVE-2026-12646 (A Missing Authorization vulnerability in Ivanti Neurons for ITSM
 CVE-2026-12645 (A Missing Authorization vulnerability in Ivanti Neurons for ITSM befor ...)
 	NOT-FOR-US: Ivanti
 CVE-2026-12611 (A client may issue HTTP/2 requests to a Jetty server that result in bl ...)
-	- jetty12 <undetermined>
-	- jetty9 <undetermined>
+	- jetty12 12.0.39-1
+	- jetty9 <unfixed>
 	NOTE: https://github.com/jetty/jetty.project/security/advisories/GHSA-gpg9-4257-cfm3
-	TODO: check, GHSA reference not yet public
 CVE-2026-12387 (Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm ...)
 	NOT-FOR-US: Arm
 CVE-2026-12285 (Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm ...)
@@ -30368,10 +30366,9 @@ CVE-2026-19843 (A flaw was found in 389-ds-base. The Cockpit 389 Console's LDAP
 	- 389-ds-base <unfixed>
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2515965
 CVE-2026-19204 (A client may send a WebSocket frame with an unknown opcode and a very  ...)
-	- jetty12 <undetermined>
-	- jetty9 <undetermined>
+	- jetty12 12.0.39-1
+	- jetty9 <not-affected> (Only affects 10.x and later)
 	NOTE: https://github.com/jetty/jetty.project/security/advisories/GHSA-85fq-fc5f-7j7g
-	TODO: check, GHSA reference not yet public
 CVE-2026-18922 (A flaw was found in 389 Directory Server. During SASL PLAIN authentica ...)
 	- 389-ds-base <unfixed>
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2511388
@@ -92877,11 +92874,10 @@ CVE-2025-12011 (A denial-of-service issue existsin5370/5570controllers. This vul
 CVE-2025-11698 (A denial-of-service issue exists in5380/5480/5580controllersbootfirmwa ...)
 	NOT-FOR-US: Rockwell Automation
 CVE-2024-7708 (For requests that have a body, but reading the body may end up in read ...)
-	- jetty12 <undetermined>
-	- jetty9 <undetermined>
+	- jetty12 <not-affected> (Fixed before initial upload of 12 to the archive)
+	- jetty9 <not-affected> (Only affects 10.x and later)
 	NOTE: https://github.com/jetty/jetty.project/security/advisories/GHSA-9299-c6m4-mjhc
 	NOTE: https://github.com/jetty/jetty.project/pull/12156
-	TODO: check
 CVE-2026-15719 (We are aware that exploit code for this is public however we are not a ...)
 	{DSA-6418-1 DSA-6394-1 DLA-4727-1 DLA-4695-1}
 	- firefox 152.0.6-1



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/107cf7ad44313f523be861da677cd2eaa1150305

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/107cf7ad44313f523be861da677cd2eaa1150305
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260929/0dc66970/attachment-0001.htm>