Showing 1 - 3 of 3

CVE-2019-17638

Status Candidate

Overview

In Eclipse Jetty, versions 9.4.27.v20200227 to 9.4.29.v20200521, in case of too large response headers, Jetty throws an exception to produce an HTTP 431 error. When this happens, the ByteBuffer containing the HTTP response headers is released back to the ByteBufferPool twice. Because of this double release, two threads can acquire the same ByteBuffer from the pool and while thread1 is about to use the ByteBuffer to write response1 data, thread2 fills the ByteBuffer with other data. Thread1 then proceeds to write the buffer that now contains different data. This results in client1, which issued request1 seeing data from another request or response which could contain sensitive data belonging to client2 (HTTP session ids, authentication credentials, etc.). If the Jetty version cannot be upgraded, the vulnerability can be significantly reduced by configuring a responseHeaderSize significantly larger than the requestHeaderSize (12KB responseHeaderSize and 8KB requestHeaderSize).

Related Files

Red Hat Security Advisory 2020-4223-01: Posted Oct 22, 2020; Authored by Red Hat | Site access.redhat.com; Red Hat Security Advisory 2020-4223-01 - Jenkins is a continuous integration server that monitors executions of repeated jobs, such as building a software project or jobs run by cron. Issues addressed include cross site scripting and information leakage vulnerabilities.; tags | advisory, vulnerability, xss; systems | linux, redhat; advisories | CVE-2019-17638, CVE-2020-2229, CVE-2020-2230, CVE-2020-2231; MD5 | d0c5b1c008c134269b1f1ca9e4034d08; Download | Favorite | View

Red Hat Security Advisory 2020-4220-01: Posted Oct 13, 2020; Authored by Red Hat | Site access.redhat.com; Red Hat Security Advisory 2020-4220-01 - Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. Issues addressed include cross site scripting and information leakage vulnerabilities.; tags | advisory, vulnerability, xss; systems | linux, redhat; advisories | CVE-2019-17638, CVE-2020-2229, CVE-2020-2230, CVE-2020-2231; MD5 | 4d38b8f4e16437e106eb7993cdf9320f; Download | Favorite | View

Red Hat Security Advisory 2020-3841-01: Posted Sep 30, 2020; Authored by Red Hat | Site access.redhat.com; Red Hat Security Advisory 2020-3841-01 - Jenkins is a continuous integration server that monitors executions of repeated jobs, such as building a software project or jobs run by cron. Issues addressed include cross site scripting and information leakage vulnerabilities.; tags | advisory, vulnerability, xss; systems | linux, redhat; advisories | CVE-2019-17638, CVE-2020-2229, CVE-2020-2230, CVE-2020-2231; MD5 | d751adac6b30eb639b46cc4de551f362; Download | Favorite | View

Page 1 of 1 Back 1 Next

Top Authors In Last 30 Days

Red Hat 167 files
Ubuntu 65 files
LiquidWorm 14 files
Gentoo 12 files
Google Security Research 11 files
Jyotsna Adhana 8 files
Ankita Pal 7 files
Alexei Kojenov 5 files
Glazvunov 5 files
George Tsimpidas 5 files

File Archives

Systems

AIX (418)
Apple (1,742)
BSD (368)
Cisco (1,898)
Debian (5,945)
Fedora (1,688)
FreeBSD (1,241)
Gentoo (3,958)
HPUX (872)
iOS (274)
iPhone (108)
IRIX (220)
Juniper (67)
Linux (38,682)
Mac OS X (669)
Mandriva (3,105)
NetBSD (255)
OpenBSD (472)
RedHat (9,205)
Slackware (941)
Solaris (1,593)
SUSE (1,444)
Ubuntu (6,952)
UNIX (8,760)
UnixWare (179)
Windows (5,676)
Other

CVE-2019-17638

Overview

Related Files

File Archive:

October 2020

Top Authors In Last 30 Days

File Tags

File Archives

Systems