CVE-2019-17632 - jetty: generation of default unhandled error response content does not escape exception messages in stacktraces included in error output

Back Back to CVE browser

MEDIUM

jetty: generation of default unhandled error response content does not escape exception messages in stacktraces included in error output

Published Nov 25, 2019

6.1

MEDIUM

CVSS 3.1

EPSS 1.91%

Description

In Eclipse Jetty versions 9.4.21.v20190926, 9.4.22.v20191022, and 9.4.23.v20191118, the generation of default unhandled Error response content (in text/html and text/json Content-Type) does not escape Exception messages in stacktraces included in error output.

Affected products

Vendor The Eclipse Foundation Product Eclipse Jetty Default
n/a
- Version
  9.4.21.v20190926
  Status
  affected
  Constraints
  -
- Version
  9.4.22.v20191022
  Status
  affected
  Constraints
  -
- Version
  9.4.23.v20191118
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

The Eclipse Foundation

Eclipse Jetty

n/a

Version	Status	Constraints
9.4.21.v20190926	affected	-
9.4.22.v20191022	affected	-
9.4.23.v20191118	affected	-

Red Hat Enterprise Linux 6

jetty-eclipse

Not affected
Red Hat Enterprise Linux 7

jetty

Not affected
Red Hat Fuse 7

jetty

Not affected
Red Hat JBoss Fuse 6

jetty

Out of support scope
Red Hat JBoss Fuse Service Works 6

jetty

Out of support scope
Red Hat Satellite 5

nutch

Out of support scope
Red Hat Single Sign-On 7

jetty

Not affected
Red Hat Software Collections

rh-java-common-jetty

Not affected

Product	Package	State	Advisory
Red Hat Enterprise Linux 6	jetty-eclipse	Not affected	n/a
Red Hat Enterprise Linux 7	jetty	Not affected	n/a
Red Hat Fuse 7	jetty	Not affected	n/a
Red Hat JBoss Fuse 6	jetty	Out of support scope	n/a
Red Hat JBoss Fuse Service Works 6	jetty	Out of support scope	n/a
Red Hat Satellite 5	nutch	Out of support scope	n/a
Red Hat Single Sign-On 7	jetty	Not affected	n/a
Red Hat Software Collections	rh-java-common-jetty	Not affected	n/a

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (10)

https://access.redhat.com/security/cve/CVE-2019-17632
Vendor Advisory
https://bugs.eclipse.org/bugs/show_bug.cgi?id=553443
x_refsource_CONFIRMIssue TrackingVendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1781214
Issue Tracking
https://github.com/advisories/GHSA-5h9j-q6j2-253f
Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SAITZ27GKPD2CCNHGT2VBT4VWIBUJJNS/
vendor-advisoryx_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SAITZ27GKPD2CCNHGT2VBT4VWIBUJJNS/
https://nvd.nist.gov/vuln/detail/CVE-2019-17632
https://www.cve.org/CVERecord?id=CVE-2019-17632
https://www.oracle.com/security-alerts/cpuApr2021.html
x_refsource_MISC
https://www.oracle.com/security-alerts/cpuoct2020.html
x_refsource_MISC

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2019-17632		Vendor Advisory
https://bugs.eclipse.org/bugs/show_bug.cgi?id=553443		x_refsource_CONFIRMIssue TrackingVendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1781214		Issue Tracking
https://github.com/advisories/GHSA-5h9j-q6j2-253f		Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SAITZ27GKPD2CCNHGT2VBT4VWIBUJJNS/		vendor-advisoryx_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SAITZ27GKPD2CCNHGT2VBT4VWIBUJJNS/
https://nvd.nist.gov/vuln/detail/CVE-2019-17632
https://www.cve.org/CVERecord?id=CVE-2019-17632
https://www.oracle.com/security-alerts/cpuApr2021.html		x_refsource_MISC
https://www.oracle.com/security-alerts/cpuoct2020.html		x_refsource_MISC