oss-security - CVE-2015-2080 - Jetty remote unauthenticated credential exposure

Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers

[<prev] [next>] [day] [month] [year] [list]

Date: Wed, 25 Feb 2015 05:59:41 -0500 (EST)
From: cve-assign@...re.org
To: oss-security@...ts.openwall.com
Cc: cve-assign@...re.org
Subject: CVE-2015-2080 - Jetty remote unauthenticated credential exposure

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

CVE-2015-2080 has been assigned to this issue in which Jetty sends an
HTTP response to one client containing HTTP request data from a
different client:

  http://dev.eclipse.org/mhonarc/lists/jetty-announce/msg00074.html
  https://github.com/eclipse/jetty.project/blob/master/advisories/2015-02-24-httpparser-error-buffer-bleed.md
  http://blog.gdssecurity.com/labs/2015/2/25/jetleak-vulnerability-remote-leakage-of-shared-buffers-in-je.html

- -- 
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)

iQEcBAEBAgAGBQJU7ap3AAoJEKllVAevmvmsDnEH/ikj6IU/6p1JtEu4Z7gQfsyq
0ZVsgz1qLbskRENzifL8XVemf+yjKryUJXGfFDFGPFc/2WsaqeaBoedsoAsfvDfg
ZjfueEQJU6ZHkXaLGodZrp7s/GAZOEbHxQ6Tw+dsdO8pVS8j83xQXGTrBlKOBs+x
nw8CwPS2dOwFkU58G4ja5O9xzpM2/Ry0l+/z6W72JywK9FAZQzR3OpUdx3LhJRRz
KtqDu6pDNUAetjyM0uVhKWjdBqzMbR+ZWDs20oeXrs4KTwHvItWcxz5frFErJeCw
MgAKS1j0lujlSbGyQiC+lnrze5QbVY2zWusV78XjJKgreUHxLlqv5QVQ4A+GylI=
=2yu/
-----END PGP SIGNATURE-----

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.