This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2019-17632 →

DEBIAN-CVE-2019-17632

In Eclipse Jetty versions 9.4.21.v20190926, 9.4.22.v20191022, and 9.4.23.v20191118, the generation of default unhandled Error response content (in tex...

Original description

The description as published by the source.

In Eclipse Jetty versions 9.4.21.v20190926, 9.4.22.v20191022, and 9.4.23.v20191118, the generation of default unhandled Error response content (in text/html and text/json Content-Type) does not escape Exception messages in stacktraces included in error output.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 jetty9

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.26-1"}]}]

Debian:13 jetty9

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.26-1"}]}]

Debian:14 jetty9

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.26-1"}]}]

References

advisory security-tracker.debian.org