CVE-2023-26049
1 advisory.
Maven/org.eclipse.jetty:jetty-server CVE-2023-26049: low 2.4, EPSS 1.30%
Eclipse Jetty's cookie parsing of quoted values can exfiltrate values from other cookies
Action: Upgrade org.eclipse.jetty:jetty-server to 9.4.51.v20230217 (9.x), 10.0.14 (10.x), 11.0.14 (11.x) or 12.0.0.beta0 (12.x) or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 9.4.51.v20230217 | - |
| 10.0.0 | 10.0.14 | - |
| 11.0.0 | 11.0.14 | - |
| 12.0.0alpha0 | 12.0.0.beta0 | - |
Fixed versions
| 9.4.51.v20230217 | 10.0.14 | 11.0.14 | 12.0.0.beta0 |
Sources
- osv: GHSA-p26g-97m4-6q7c
- https://github.com/eclipse/jetty.project/security/advisories/GHSA-p26g-97m4-6q7c
- https://nvd.nist.gov/vuln/detail/CVE-2023-26049
- https://github.com/eclipse/jetty.project/pull/9339
- https://github.com/eclipse/jetty.project/pull/9352
- https://github.com/eclipse/jetty.project
- https://github.com/eclipse/jetty.project/releases/tag/jetty-9.4.51.v20230217
- https://lists.debian.org/debian-lts-announce/2023/09/msg00039.html
- https://security.netapp.com/advisory/ntap-20230526-0001
- https://www.debian.org/security/2023/dsa-5507
- https://www.rfc-editor.org/rfc/rfc2965
- https://www.rfc-editor.org/rfc/rfc6265
CVE-2023-26049 · published · modified · JSON