|Re: [jetty-announce] [jetty-users] Indexing/Listing Vulnerability in Jetty|
Thank you for all of your excellent work over the years.
I am using a customized, embedded version of Jetty (which is an OSS project that I hope to publicly launch soon!) that does not use either one. I’m ok, right? (Although it would not be a big deal to upgrade to the latest Jetty, so maybe I should upgrade anyhow.)
From: jetty-users-bounces@xxxxxxxxxxx <jetty-users-bounces@xxxxxxxxxxx> On Behalf Of Chris Walker
Sent: Monday, April 22, 2019 11:32
To: JETTY user mailing list <jetty-users@xxxxxxxxxxx>; Jetty @ Eclipse developer discussion list <jetty-dev@xxxxxxxxxxx>; jetty-announce@xxxxxxxxxxx
Subject: [jetty-users] Indexing/Listing Vulnerability in Jetty
Greetings from the team at Webtide. We wanted to make you aware of a vulnerability that was recently discovered in Jetty and reported as CVE-2019-10241, CVE-2019-10246 and CVE-2019-10247.
If you are using DefaultServlet or ResourceHandler with indexing/listing, then you are vulnerable to a variant of XSS behaviors surrounding the use of injected HTML element attributes on the parent directory link. We recommend disabling indexing/listing or upgrading to a non-vulnerable version.
We have put together a blog post that contains more information on how to disable indexing/listing, which can be found on the Webtide website.
Additionally, we discovered that usages of DefaultHandler were susceptible to a similar leak of information. If no webapp was mounted on the root "/" namespace, a page would be generated with links to other namespaces. This has been the default behavior in Jetty for years, but we have removed this to safeguard data.
As a result of these CVEs, we have released new versions for the 9.2.x, 9.3.x, and 9.4.x branches. The most up-to-date versions of all three are as follows, and are available both on the Jetty website and Maven Central.
- 9.2.26 and older (now EOL)
- 9.3.25 and older
- 9.4.15 and older
The Webtide Team
jetty-users mailing list
To change your delivery options, retrieve your password, or unsubscribe from this list, visit
Back to the top