CVE-2015-2080: Jetty vulnerable to exposure of sensitive information to unauthenticated remote users
Summary
CVE-2015-2080: Jetty vulnerable to exposure of sensitive information to unauthenticated remote users. Affects org.eclipse.jetty:jetty-server versions < 9.2.9.v20150224. Fixed in 9.2.9.v20150224. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jetty package is a Java-based web server and servlet container that provides support for HTTP/2, WebSocket, and other Java-based web technologies. It is widely used in various applications and frameworks. However, versions prior to 9.2.9.v20150224 are susceptible to a vulnerability known as JetLeak, which allows remote attackers to obtain sensitive information from process memory by exploiting illegal characters in an HTTP header.
Vulnerability Detail
The vulnerability in Jetty, known as JetLeak (CVE-2015-2080), arises from a flaw in the exception handling code. By sending specially crafted HTTP headers with illegal characters, an unauthenticated remote attacker can access sensitive information stored in the process memory. This can lead to the exposure of confidential data, such as passwords or session tokens. The vulnerability has a CVSS score of 7.5, indicating a high severity level. It is crucial to address this issue promptly to prevent unauthorized access and potential data breaches.
How To Fix
Minimum fixed version
9.2.9.v20150224
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating of the Jetty package is not feasible, a temporary workaround can be implemented by disabling the affected functionality or blocking requests that exploit the vulnerability. This can be achieved by configuring the web server or application firewall to filter out HTTP headers containing illegal characters. However, this workaround should be considered temporary, and it is strongly advised to apply the official fix as soon as possible.
Conclusion
The Jetty package prior to version 9.2.9.v20150224 is vulnerable to the JetLeak vulnerability, which allows unauthenticated remote attackers to access sensitive information from process memory. To mitigate this issue, it is crucial to update the Jetty package to the recommended version or apply the provided workaround. Failure to address this vulnerability may result in unauthorized access and potential data breaches. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.eclipse.jetty:jetty-server →
FAQ
Jetty is a Java-based web server and servlet container that provides support for various web technologies.
The JetLeak vulnerability (CVE-2015-2080) is a flaw in Jetty that allows remote attackers to access sensitive information from process memory by exploiting illegal characters in HTTP headers.
The vulnerability can lead to the exposure of sensitive data, such as passwords or session tokens, which can be used by attackers for unauthorized access or data breaches.
To fix this vulnerability, update the Jetty package to version 9.2.9.v20150224 or later. Refer to the provided 'how_to_fix' section for detailed instructions.
A temporary workaround involves disabling the affected functionality or blocking requests that exploit the vulnerability. However, it is recommended to apply the official fix as soon as possible.
Related vulnerabilities
Recent vulnerabilities recorded for org.eclipse.jetty:jetty-server.
