Skip to main content
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] [List Home]
Re: [jetty-users] Security Advisory GHSA-2fvj-hgj9-j2gr?
  • From: Joerg Hoh <jhoh@xxxxxxxxx>
  • Date: Mon, 14 Sep 2026 16:51:08 +0000
  • Accept-language: de-DE, en-US
  • Arc-authentication-results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=adobe.com; dmarc=pass action=none header.from=adobe.com; dkim=pass header.d=adobe.com; arc=none
  • Arc-message-signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=UXyoDaIFUSvU68p5VDRFSVWUnM7M5rghUFD6OB0svEg=; b=muN4ftLdbBPvr82uT4Hlk+/mr14mokJ3F6co3TxU8VsnabLTQO1BGPtKA9aKD5/9IGhfsHe9hT8XRe/sQaHDNx5zDQZOxoWhB3A9+JQxWFpmG/Jam2njRQTk6HAIAfRVekKnrUwXiPzKZcUkPAIZ1fBRvycSgLVk2e/twhl3MvpXvgnh31OKU6DqWwYO8TX56FusELAa0C5lHMcfkJXkzGldtmfHJ79baYZc+hp1eFM4nIpDPRJ4VHt5YF6oHm2fo/zes2tjMvXk8h9AzerBTr84mfz5FAHQloKspEUaqrGJt/G+LS2E3H+52cSbyCgAWlbM0cSQzq+zsrm776jM2Q==
  • Arc-seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=Nsy4OQpFJPNzDDNxaQ9VrSyX62zkxag6xc+6THuxt8Tyt1+9B7Ti92udBTfzSActJ9AUyqQbh0aA1GJAESzfvahnPBeg/QnGX5Q+Oj3H2Cm+eZDsXp4JTTe7XApiuwAw42O72xZBB7/37ozt8CIOGiVq5StUxppnVpMDkenGhTHaUPhGJKYZSK5YfUo8PdPoxk04DznHXD2WQwgGW+z9PxkWkb12UqAeWKVcyr3a6y4LN/tqxst9FH2p4szisCrQLyw79z0j5qz2LHQIeFn5gmNE+4zK0HQAsLAy5U+HsJGCjvOSUyqk9uJa4S+3VD3SdHUhcgv+PFAff4dx3KV0OQ==
  • Delivered-to: jetty-users@xxxxxxxxxxx
  • List-archive: <https://www.eclipse.org/mailman/private/jetty-users/>
  • List-help: <mailto:jetty-users-request@eclipse.org?subject=help>
  • List-subscribe: <https://www.eclipse.org/mailman/listinfo/jetty-users>, <mailto:jetty-users-request@eclipse.org?subject=subscribe>
  • List-unsubscribe: <https://www.eclipse.org/mailman/options/jetty-users>, <mailto:jetty-users-request@eclipse.org?subject=unsubscribe>
  • Thread-index: AQHdRBw/sXJMG3g3y0qoMQ4aIGB66LbOSE0AgAAAZWg=
  • Thread-topic: [jetty-users] Security Advisory GHSA-2fvj-hgj9-j2gr?
Hi Jesse,

I understand that these branches are EOL, and support for them is only available via a payed contract.

I just wonder why for this particular security advisory patched versions are listed, although these versions do not exist on Maven Central. The hint “Patched versions for these EOLed branches are available from Webtide” would have made the situation much more obvious.

Jörg

-- 
Jörg Hoh  |  Joerg.Hoh@xxxxxxxxx
Adobe Systems Engineering GmbH - Grosse Elbstrasse 27 - 22767 Hamburg
Sitz der Gesellschaft: Hamburg - Registergericht: Hamburg HRB 745 37 
Geschäftsführer: Michael D. Jamrosy, Christian Keim, Thomas Mührke, Scott Andrew Kennedy


From: Jesse McConnell <jesse.mcconnell@xxxxxxxxx>
Date: Monday, 14. September 2026 at 18:44
To: JETTY user mailing list <jetty-users@xxxxxxxxxxx>
Cc: Joerg Hoh <jhoh@xxxxxxxxx>
Subject: Re: [jetty-users] Security Advisory GHSA-2fvj-hgj9-j2gr?

EXTERNAL: Use caution when clicking on links or opening attachments.


Please read: https://github.com/jetty/jetty.project/issues/13918

If you would like to talk about it, feel free to book an appointment with me here: https://webtide.com/book/

cheers,
Jesse

--
jesse mcconnell
jesse.mcconnell@xxxxxxxxx


On Mon, Sep 14, 2026 at 2:48 AM Joerg Hoh via jetty-users <jetty-users@xxxxxxxxxxx> wrote:
Hi,

I have a question regarding the security advisory published at https://github.com/jetty/jetty.project/security/advisories/GHSA-2fvj-hgj9-j2gr?

It lists these patched versions for org.eclipse.jetty:jetty-security 

9.4.x : 9.4.62
10.0.x: 10.0.31 
11.0.x: 11.0.31

But all of them are not available at Maven Central (https://repo1.maven.org/maven2/org/eclipse/jetty/jetty-security/). They also don’t exist in git.

I understand that these branches are EOL.

My question is: Can you fix your advisory and just list the branches for which patched versions are available? 

Thanks,
Jörg


-- 
Jörg Hoh  
Sitz der Gesellschaft: Hamburg - Registergericht: Hamburg HRB 745 37 
Geschäftsführer: Michael D. Jamrosy, Christian Keim, Thomas Mührke, Scott Andrew Kennedy

_______________________________________________
jetty-users mailing list
jetty-users@xxxxxxxxxxx
To unsubscribe from this list, visit https://www.eclipse.org/mailman/listinfo/jetty-users

Back to the top