Alerts This Week
Warning Icon 1 914
Alerts This Week
Warning Icon 1 914

Fedora 9: 2009-5500 Critical: Jetty DoS Security Update

fedora
Calendar Grey May 26, 2009
Dist Fedora Esm H88
Enhancing security in Fedora 9 requires addressing CVE-2009-1523 in Jetty. Follow this advisory to update Jetty and protect against potential risks.
This build upgrades jetty to 5.1.15 which addresses CVE-2009-1523

Summary

Jetty is a 100% Java HTTP Server and Servlet Container.

This means that you do not need to configure and run a

separate web server (like Apache) in order to use java,

servlets and JSPs to generate dynamic content. Jetty is

a fully featured web server for static and dynamic content.

Unlike separate server/container solutions, this means

that your web server and web application run in the same

process, without interconnection overheads and complications.

Furthermore, as a pure java component, Jetty can be simply

included in your application for demonstration, distribution

or deployment. Jetty is available on all Java supported

platforms.

Update Information:

This build upgrades jetty to 5.1.15 which addresses CVE-2009-1523

Topics%20covered

Topics Covered

security advisory critical Fedora DoS software upgrade jetty

Change Log

* Thu May 21 2009 Jeff Johnston 5.1.15-3 - Do not allow directory listings. - Bump up release number. * Tue May 19 2009 Jeff Johnston 5.1.15-1 - Upgrade to 5.1.15 source tarball for Fedora. * Wed Apr 22 2009 Jeff Johnston 5.1.14-3 - Add %{libdir} to files list. - Resolves #473585 * Wed Feb 11 2009 Jeff Johnston 5.1.14-1.10 - Rename jettyc back to .jettyrc. - Resolves #485012 * Tue Feb 3 2009 Jeff Johnston 5.1.14-1.9 - Change %{_sysconfdir}/init.d references to be %{_initrddir} * Mon Feb 2 2009 Jeff Johnston 5.1.14-1.8 - Fixes for unowned directories. * Tue Jan 6 2009 Jeff Johnston 5.1.14-1.7 - Patch init.d script to add status operation - Patch unix djetty script so it doesn't issue error messages about /dev/tty and fix various inconsistencies with the init.d script * Tue Aug 12 2008 Andrew Overholt 5.1.14-1.6 - Require tomcat5 bits with proper OSGi metadata * Fri Jul 11 2008 Andrew Overholt 5.1.14-1.5 - Bump release. * Fri Jul 11 2008 Andrew Overholt 5.1.14-1.3 - Update OSGi manifest * Wed Jul 9 2008 Tom "spot" Callaway - 5.1.14-1.3 - drop repotag

References


[ 1 ] Bug #499867 - CVE-2009-1523 CVE-2009-1524: multiple vulnerabilities in jetty https://bugzilla.redhat.com/show_bug.cgi?id=499867

Update Instructions

This update can be installed with the "yum" update program. Use su -c 'yum update jetty' at the command line. For more information, refer to "Managing Software with yum", available at .

Severity
critical
Lowest
Low
Medium
High
Critical

Name: jetty
Product: Fedora 9
Version: 5.1.15
Release: 3.fc9
URL: Summary : The Jetty Webserver and Servlet Container

Topics%20covered

Topics Covered

security advisory critical Fedora DoS software upgrade jetty

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here