Eclipse Jetty 9.x Error Response Content Vulnerability - CVE-2019-17632
Summary
CVE-2019-17632: In Eclipse Jetty versions 9.4.21.v20190926, 9.4.22.v20191022, and 9.4.23.v20191118, the generation of default unhandled Error response content (in text/html and text/json Content-Type) does not escape Exception messages... Affects jetty9 across 4 version ranges.
< 9.4.26-1
< 72970db61a2904371e1218a95a3bef5d79788c33
< abbccc65d6cf5e8806dd35881147d618b9b5740b
< b1e6b55512e008f7fbdf1cbea4ff8a6446d1073b
Fixed in 9.4.26-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Eclipse Jetty is a widely used open-source Java-based web server and servlet container that provides a robust environment for running web applications. It is known for its scalability, performance, and ease of integration with various Java frameworks. The vulnerability in question affects specific versions of Jetty 9, where the default unhandled error response content does not properly escape exception messages in stack traces, potentially exposing sensitive information to users.
Vulnerability Detail
CVE-2019-17632 is a vulnerability found in Eclipse Jetty versions 9.4.21.v20190926, 9.4.22.v20191022, and 9.4.23.v20191118. The issue arises from the generation of default unhandled error response content in both text/html and text/json formats, where exception messages in stack traces are not escaped. This can lead to information disclosure, as attackers could exploit this flaw to view sensitive details about the server's internal state, including stack traces that may contain confidential information.
How To Fix
Minimum fixed version
9.4.26-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade jetty9Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If an immediate upgrade is not feasible, a temporary workaround is to configure Jetty to suppress detailed error messages in production environments. This can be done by adjusting the error handling settings in the Jetty configuration files to return generic error messages instead of detailed stack traces.
Conclusion
CVE-2019-17632 is a significant vulnerability affecting specific versions of Eclipse Jetty, which could lead to information disclosure through unescaped error messages. Users are strongly advised to upgrade to the latest version to mitigate this risk. Additionally, employing monitoring tools like Vulert can enhance security by providing real-time alerts for vulnerabilities.
See every vulnerability recorded for jetty9 →
FAQ
The affected versions are 9.4.21.v20190926, 9.4.22.v20191022, and 9.4.23.v20191118.
The CVSS score for this vulnerability is 6.1, indicating a medium severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Not addressing this vulnerability could lead to information disclosure, where attackers can gain insights into the server's internal workings, potentially leading to further exploitation.
Yes, using tools like Vulert, which monitors and alerts for open-source vulnerabilities in real-time based on your manifest files, can help keep your applications secure.
Related vulnerabilities
Recent vulnerabilities recorded for jetty9.
