Skip to main content
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] [List Home]
Re: [jetty-users] Security Advisory GHSA-2fvj-hgj9-j2gr?
Ah, that should have been included. I'll check with the team and make sure that it is clearer. 

cheers,
Jesse

--
jesse mcconnell
jesse.mcconnell@xxxxxxxxx


On Mon, Sep 14, 2026 at 11:51 AM Joerg Hoh <jhoh@xxxxxxxxx> wrote:
Hi Jesse,

I understand that these branches are EOL, and support for them is only available via a payed contract.

I just wonder why for this particular security advisory patched versions are listed, although these versions do not exist on Maven Central. The hint “Patched versions for these EOLed branches are available from Webtide” would have made the situation much more obvious.

Jörg

-- 
Jörg Hoh  |  Joerg.Hoh@xxxxxxxxx
Adobe Systems Engineering GmbH - Grosse Elbstrasse 27 - 22767 Hamburg
Sitz der Gesellschaft: Hamburg - Registergericht: Hamburg HRB 745 37 
Geschäftsführer: Michael D. Jamrosy, Christian Keim, Thomas Mührke, Scott Andrew Kennedy


From: Jesse McConnell <jesse.mcconnell@xxxxxxxxx>
Date: Monday, 14. September 2026 at 18:44
To: JETTY user mailing list <jetty-users@xxxxxxxxxxx>
Cc: Joerg Hoh <jhoh@xxxxxxxxx>
Subject: Re: [jetty-users] Security Advisory GHSA-2fvj-hgj9-j2gr?

EXTERNAL: Use caution when clicking on links or opening attachments.



If you would like to talk about it, feel free to book an appointment with me here: https://webtide.com/book/

cheers,
Jesse

--
jesse mcconnell
jesse.mcconnell@xxxxxxxxx


On Mon, Sep 14, 2026 at 2:48 AM Joerg Hoh via jetty-users <jetty-users@xxxxxxxxxxx> wrote:
Hi,

I have a question regarding the security advisory published at https://github.com/jetty/jetty.project/security/advisories/GHSA-2fvj-hgj9-j2gr?

It lists these patched versions for org.eclipse.jetty:jetty-security 

9.4.x : 9.4.62
10.0.x: 10.0.31 
11.0.x: 11.0.31

But all of them are not available at Maven Central (https://repo1.maven.org/maven2/org/eclipse/jetty/jetty-security/). They also don’t exist in git.

I understand that these branches are EOL.

My question is: Can you fix your advisory and just list the branches for which patched versions are available? 

Thanks,
Jörg


-- 
Jörg Hoh  
Sitz der Gesellschaft: Hamburg - Registergericht: Hamburg HRB 745 37 
Geschäftsführer: Michael D. Jamrosy, Christian Keim, Thomas Mührke, Scott Andrew Kennedy

_______________________________________________
jetty-users mailing list
jetty-users@xxxxxxxxxxx
To unsubscribe from this list, visit https://www.eclipse.org/mailman/listinfo/jetty-users

Back to the top