Jetty vulnerable to exposure of sensitive information to unauthenticated remote users

HIGH 7.5CVE-2015-2080 · GHSA-ghgj-3xqr-6jfm · Published 07/10/2016 · updated 17/06/2026

Package	Affected versions	Patched versions
org.eclipse.jetty:jetty-server Maven	`< 9.2.9.v20150224`	`9.2.9.v20150224`
jetty eclipse	`= 9.2.3= 9.2.4= 9.2.5= 9.2.6= 9.2.7= 9.2.8= 9.3.0`	No fix yet

Description

The exception handling code in Eclipse Jetty prior to 9.2.9.v20150224 allows remote attackers to obtain sensitive information from process memory via illegal characters in an HTTP header, aka JetLeak.

NVD description

The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote attackers to obtain sensitive information from process memory via illegal characters in an HTTP header, aka JetLeak.

References

nvd.nist.gov/vuln/detail/CVE-2015-2080 · ADVISORY
blog.gdssecurity.com/labs/2015/2/25/jetleak-vulnerability-remote-leakage-of-shared-buffers-in-je.html · WEB
GitHub Advisory GHSA-ghgj-3xqr-6jfm · ADVISORY
eclipse/jetty.project · WEB
security.netapp.com/advisory/ntap-20190307-0005 · WEB
dev.eclipse.org/mhonarc/lists/jetty-announce/msg00074.html · WEB
dev.eclipse.org/mhonarc/lists/jetty-announce/msg00075.html · WEB
lists.fedoraproject.org/pipermail/package-announce/2015-March/151804.html · WEB
packetstormsecurity.com/files/130567/Jetty-9.2.8-Shared-Buffer-Leakage.html · WEB
seclists.org/fulldisclosure/2015/Mar/12 · WEB
securityfocus.com/archive/1/534755/100/1600/threaded · WEB
securityfocus.com/bid/72768 · WEB
securitytracker.com/id/1031800 · WEB
security.netapp.com/advisory/ntap-20190307-0005

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free