CVE-2019-10241
Fixed in a distro release EPSS 9%
In Eclipse Jetty version 9.2.26 and older, 9.3.25 and older, and 9.4.15 and older, the server is vulnerable to XSS conditions if a remote client USES a specially formatted URL against the DefaultServlet or ResourceHandler that is configured for showing a Listing of directory contents.
Products: The Eclipse Foundation Eclipse Jetty
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.eclipse.jetty:jetty-server | 9.2.27.v20190403 |
| Maven | org.eclipse.jetty:jetty-server | 9.3.26.v20190403 |
| Maven | org.eclipse.jetty:jetty-server | 9.4.16.v20190411 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | hadoop-fips-3.3.6 | no fix |
| Chainguard | hadoop-fips-3.4.2 | no fix |
| Chainguard | hadoop-fips-3.5 | no fix |
| Debian 10 | jetty9 | 9.4.16-0+deb10u1 |
| Debian 12 | jetty9 | 9.4.18-2 |
| Debian 13 | jetty9 | 9.4.18-2 |
| Debian 14 | jetty9 | 9.4.18-2 |
| Debian 9 | jetty9 | 9.2.30-0+deb9u1 |
| Ubuntu 14.04 LTS | jetty | no fix |
| Ubuntu 14.04 LTS | jetty8 | no fix |
| Ubuntu 16.04 LTS | jetty | no fix |
| Ubuntu 16.04 LTS | jetty8 | no fix |
| Ubuntu 18.04 LTS | jetty9 | no fix |