CVE-2015-2080

Sažetak

The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote attackers to obtain sensitive information from process memory via illegal characters in an HTTP header, aka JetLeak.

Reference

http://dev.eclipse.org/mhonarc/lists/jetty-announce/msg00074.html
http://dev.eclipse.org/mhonarc/lists/jetty-announce/msg00075.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151804.html
http://packetstormsecurity.com/files/130567/Jetty-9.2.8-Shared-Buffer-Leakage.html
http://seclists.org/fulldisclosure/2015/Mar/12
http://www.securityfocus.com/archive/1/534755/100/1600/threaded
http://www.securityfocus.com/bid/72768
http://www.securitytracker.com/id/1031800
https://blog.gdssecurity.com/labs/2015/2/25/jetleak-vulnerability-remote-leakage-of-shared-buffers-in-je.html
https://github.com/eclipse/jetty.project/blob/jetty-9.2.x/advisories/2015-02-24-httpparser-error-buffer-bleed.md
https://security.netapp.com/advisory/ntap-20190307-0005/

CVSS

Base:	5.0
Impact:	2.9
Exploitability:	10.0

Pristup

Vektor	Složenost	Autentikacija
NETWORK	LOW	NONE

Impact

Povjerljivost	Cjelovitost	Dostupnost
PARTIAL	NONE	NONE

CVSS vektor

AV:N/AC:L/Au:N/C:P/I:N/A:N

Zadnje važnije ažuriranje

08-03-2019 - 11:29

Objavljeno

07-10-2016 - 14:59