RedHat: RHSA-2021-1509:01 Moderate: rh-eclipse-jetty security updat...

Advisories

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Moderate: rh-eclipse-jetty security update
Advisory ID:       RHSA-2021:1509-01
Product:           Red Hat Developer Tools
Advisory URL:      https://access.redhat.com/errata/RHSA-2021:1509
Issue date:        2021-05-05
CVE Names:         CVE-2021-28163 CVE-2021-28164 CVE-2021-28165 
=====================================================================

1. Summary:

An update for rh-eclipse-jetty is now available for Red Hat Developer
Tools.

Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7) - noarch
Red Hat Developer Tools for Red Hat Enterprise Linux Workstation (v. 7) - noarch

3. Description:

Jetty is a 100% Java HTTP Server and Servlet Container.

The following packages have been upgraded to a later upstream version:
rh-eclipse-jetty (9.4.40).

Security Fix(es):

* jetty: Symlink directory exposes webapp directory contents
(CVE-2021-28163)

* jetty: Ambiguous paths can access WEB-INF (CVE-2021-28164)

* jetty: Resource exhaustion when receiving an invalid large TLS frame
(CVE-2021-28165)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

1945710 - CVE-2021-28163 jetty: Symlink directory exposes webapp directory contents
1945712 - CVE-2021-28164 jetty: Ambiguous paths can access WEB-INF
1945714 - CVE-2021-28165 jetty: Resource exhaustion when receiving an invalid large TLS frame

6. Package List:

Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7):

Source:
rh-eclipse-jetty-9.4.40-1.1.el7_9.src.rpm

noarch:
rh-eclipse-jetty-9.4.40-1.1.el7_9.noarch.rpm
rh-eclipse-jetty-client-9.4.40-1.1.el7_9.noarch.rpm
rh-eclipse-jetty-continuation-9.4.40-1.1.el7_9.noarch.rpm
rh-eclipse-jetty-http-9.4.40-1.1.el7_9.noarch.rpm
rh-eclipse-jetty-io-9.4.40-1.1.el7_9.noarch.rpm
rh-eclipse-jetty-jaas-9.4.40-1.1.el7_9.noarch.rpm
rh-eclipse-jetty-javadoc-9.4.40-1.1.el7_9.noarch.rpm
rh-eclipse-jetty-jmx-9.4.40-1.1.el7_9.noarch.rpm
rh-eclipse-jetty-security-9.4.40-1.1.el7_9.noarch.rpm
rh-eclipse-jetty-server-9.4.40-1.1.el7_9.noarch.rpm
rh-eclipse-jetty-servlet-9.4.40-1.1.el7_9.noarch.rpm
rh-eclipse-jetty-util-9.4.40-1.1.el7_9.noarch.rpm
rh-eclipse-jetty-util-ajax-9.4.40-1.1.el7_9.noarch.rpm
rh-eclipse-jetty-webapp-9.4.40-1.1.el7_9.noarch.rpm
rh-eclipse-jetty-xml-9.4.40-1.1.el7_9.noarch.rpm

Red Hat Developer Tools for Red Hat Enterprise Linux Workstation (v. 7):

Source:
rh-eclipse-jetty-9.4.40-1.1.el7_9.src.rpm

noarch:
rh-eclipse-jetty-9.4.40-1.1.el7_9.noarch.rpm
rh-eclipse-jetty-client-9.4.40-1.1.el7_9.noarch.rpm
rh-eclipse-jetty-continuation-9.4.40-1.1.el7_9.noarch.rpm
rh-eclipse-jetty-http-9.4.40-1.1.el7_9.noarch.rpm
rh-eclipse-jetty-io-9.4.40-1.1.el7_9.noarch.rpm
rh-eclipse-jetty-jaas-9.4.40-1.1.el7_9.noarch.rpm
rh-eclipse-jetty-javadoc-9.4.40-1.1.el7_9.noarch.rpm
rh-eclipse-jetty-jmx-9.4.40-1.1.el7_9.noarch.rpm
rh-eclipse-jetty-security-9.4.40-1.1.el7_9.noarch.rpm
rh-eclipse-jetty-server-9.4.40-1.1.el7_9.noarch.rpm
rh-eclipse-jetty-servlet-9.4.40-1.1.el7_9.noarch.rpm
rh-eclipse-jetty-util-9.4.40-1.1.el7_9.noarch.rpm
rh-eclipse-jetty-util-ajax-9.4.40-1.1.el7_9.noarch.rpm
rh-eclipse-jetty-webapp-9.4.40-1.1.el7_9.noarch.rpm
rh-eclipse-jetty-xml-9.4.40-1.1.el7_9.noarch.rpm

These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2021-28163
https://access.redhat.com/security/cve/CVE-2021-28164
https://access.redhat.com/security/cve/CVE-2021-28165
https://access.redhat.com/security/updates/classification/#moderate
https://access.redhat.com/documentation/en-us/red_hat_developer_tools/1/html/using_eclipse_4.19/

8. Contact:

The Red Hat security contact is . More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2021 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBYJKdctzjgjWX9erEAQj/hw//d65KJlaPJD/RofKX/TnaGuvAzymwe+8t
ecstX0dVN9Q7wqwWUVVbA0Y6Q5q2IczBEgrZeERqFPnBcUSrFmF9ZQmdp4+fA0Xl
JcdBMVcimcnIBXZgvEEWoE9ngq71JIQH/2fbQ7XsrI1FHxf0eCpVwsG+FD+ONd03
XPWlYMvQBsAUvFmx3yj/2ngSseLV7N8CsmsdInL1PHdnPQv8GDlZ5Vu9a6QIPAXA
SD95MGY9D92n/m1H4zYLtU/Xx06X54qElNpNL9uXHERerOo69I08OV/rkDhOcTmB
5KUsSO1ddr6PMiRpnBP4Hbf0KqRk+YC6/nqa/ILjY57V3KJ/ISIYU5N/YnnWAgMC
x6gNRz/4hjZdz8cd5QWEeS9M47g4txG82BOf7SDhrVNi5zsaSDBklHJWTdJobMQP
Ufdx+TDMOX5lawCWt1eogUrIILlmo3zfreytJ6t8YNuJY1POD3VDQBenTwq9Ffve
7fVwdvmpGXxB3mmh6L7SoFrvvjN7AbdyVzRtJzbZtfL/5SRYArq+aR0ipl07hzRc
7FFh3QpVJLIKOAvhNDWFHoYpc5xAT/zXRzJHdi+wTHqG4JpkCLvWN0YvAuLNE3MX
lQW4/LOrX7qopXWtFnIMtGyBh+i0R3Hl7TaH+EfbVXpFAIqWUbHA5XhLxFtEm3C8
afEUHP6DuU0=
=QTCO
-----END PGP SIGNATURE-----

--
RHSA-announce mailing list
[email protected]
https://listman.redhat.com/mailman/listinfo/rhsa-announce

RedHat: RHSA-2021-1509:01 Moderate: rh-eclipse-jetty security update

An update for rh-eclipse-jetty is now available for Red Hat Developer Tools

Summary

Jetty is a 100% Java HTTP Server and Servlet Container.
The following packages have been upgraded to a later upstream version: rh-eclipse-jetty (9.4.40).
Security Fix(es):
* jetty: Symlink directory exposes webapp directory contents (CVE-2021-28163)
* jetty: Ambiguous paths can access WEB-INF (CVE-2021-28164)
* jetty: Resource exhaustion when receiving an invalid large TLS frame (CVE-2021-28165)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changesdescribed in this advisory, refer to:https://access.redhat.com/articles/11258

References

https://access.redhat.com/security/cve/CVE-2021-28163 https://access.redhat.com/security/cve/CVE-2021-28164 https://access.redhat.com/security/cve/CVE-2021-28165 https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/documentation/en-us/red_hat_developer_tools/1/html/using_eclipse_4.19/

Package List

Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7):
Source: rh-eclipse-jetty-9.4.40-1.1.el7_9.src.rpm
noarch: rh-eclipse-jetty-9.4.40-1.1.el7_9.noarch.rpm rh-eclipse-jetty-client-9.4.40-1.1.el7_9.noarch.rpm rh-eclipse-jetty-continuation-9.4.40-1.1.el7_9.noarch.rpm rh-eclipse-jetty-http-9.4.40-1.1.el7_9.noarch.rpm rh-eclipse-jetty-io-9.4.40-1.1.el7_9.noarch.rpm rh-eclipse-jetty-jaas-9.4.40-1.1.el7_9.noarch.rpm rh-eclipse-jetty-javadoc-9.4.40-1.1.el7_9.noarch.rpm rh-eclipse-jetty-jmx-9.4.40-1.1.el7_9.noarch.rpm rh-eclipse-jetty-security-9.4.40-1.1.el7_9.noarch.rpm rh-eclipse-jetty-server-9.4.40-1.1.el7_9.noarch.rpm rh-eclipse-jetty-servlet-9.4.40-1.1.el7_9.noarch.rpm rh-eclipse-jetty-util-9.4.40-1.1.el7_9.noarch.rpm rh-eclipse-jetty-util-ajax-9.4.40-1.1.el7_9.noarch.rpm rh-eclipse-jetty-webapp-9.4.40-1.1.el7_9.noarch.rpm rh-eclipse-jetty-xml-9.4.40-1.1.el7_9.noarch.rpm
Red Hat Developer Tools for Red Hat Enterprise Linux Workstation (v. 7):
Source: rh-eclipse-jetty-9.4.40-1.1.el7_9.src.rpm
noarch: rh-eclipse-jetty-9.4.40-1.1.el7_9.noarch.rpm rh-eclipse-jetty-client-9.4.40-1.1.el7_9.noarch.rpm rh-eclipse-jetty-continuation-9.4.40-1.1.el7_9.noarch.rpm rh-eclipse-jetty-http-9.4.40-1.1.el7_9.noarch.rpm rh-eclipse-jetty-io-9.4.40-1.1.el7_9.noarch.rpm rh-eclipse-jetty-jaas-9.4.40-1.1.el7_9.noarch.rpm rh-eclipse-jetty-javadoc-9.4.40-1.1.el7_9.noarch.rpm rh-eclipse-jetty-jmx-9.4.40-1.1.el7_9.noarch.rpm rh-eclipse-jetty-security-9.4.40-1.1.el7_9.noarch.rpm rh-eclipse-jetty-server-9.4.40-1.1.el7_9.noarch.rpm rh-eclipse-jetty-servlet-9.4.40-1.1.el7_9.noarch.rpm rh-eclipse-jetty-util-9.4.40-1.1.el7_9.noarch.rpm rh-eclipse-jetty-util-ajax-9.4.40-1.1.el7_9.noarch.rpm rh-eclipse-jetty-webapp-9.4.40-1.1.el7_9.noarch.rpm rh-eclipse-jetty-xml-9.4.40-1.1.el7_9.noarch.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/

Severity
Advisory ID: RHSA-2021:1509-01
Product: Red Hat Developer Tools
Advisory URL: https://access.redhat.com/errata/RHSA-2021:1509
Issued Date: : 2021-05-05
CVE Names: CVE-2021-28163 CVE-2021-28164 CVE-2021-28165

Topic

An update for rh-eclipse-jetty is now available for Red Hat DeveloperTools.Red Hat Product Security has rated this update as having a security impactof Moderate. A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed severity rating, is available for each vulnerability fromthe CVE link(s) in the References section.

Relevant Releases Architectures

Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7) - noarch

Red Hat Developer Tools for Red Hat Enterprise Linux Workstation (v. 7) - noarch

Bugs Fixed

1945710 - CVE-2021-28163 jetty: Symlink directory exposes webapp directory contents

1945712 - CVE-2021-28164 jetty: Ambiguous paths can access WEB-INF

1945714 - CVE-2021-28165 jetty: Resource exhaustion when receiving an invalid large TLS frame

We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.