Bug 1196254 (CVE-2015-2080)

Summary:	CVE-2015-2080 jetty: remote unauthenticated credential exposure
Product:	[Other] Security Response	Reporter:	Vasyl Kaigorodov <vkaigoro>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	arun.neelicattu+rhbz, atangrin, bleanhar, ccoleman, cperry, dmcphers, eclipse-sig, java-maint, jdetiber, jialiu, jkeck, jokerman, krzysztof.daniel, kseifried, lmeyer, mizdebsk, mkollar, mmccomas, msimacek, msrb, overholt, pmackinn, taw, tjay
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2015-05-28 10:22:39 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Vasyl Kaigorodov 2015-02-25 15:23:25 UTC

CVE-2015-2080 has been assigned to this issue in which Jetty sends an
HTTP response to one client containing HTTP request data from a
different client:

External References:

http://dev.eclipse.org/mhonarc/lists/jetty-announce/msg00074.html

Statement:

This issue did not affect the versions of jetty as shipped with Red Hat Enterprise Linux 7, versions of openshift-origin-cartridge-fuse as shipped with Red Hat OpenShift Enterprise 2.1, and versions of nutch as shipped with Red Hat Satellite 5.

Comment 1 [DISABLED] 2015-02-26 06:05:17 UTC

Victims Record:

https://github.com/victims/victims-cve-db/blob/master/database/java/2015/2080.yaml

Comment 2 [DISABLED] 2015-02-26 06:08:47 UTC

Upstream Fix:

https://github.com/eclipse/jetty.project/commit/3e7b5f0fa918633ec24bd1bc23d6ee76d32c7729
https://github.com/eclipse/jetty.project/commit/4df5647f6dfdc5fa7abb812afe9290d60b17c098

Comment 3 Fedora Update System 2015-03-13 17:28:14 UTC

jetty-9.2.9-1.fc22 has been pushed to the Fedora 22 stable repository.  If problems still persist, please make note of it in this bug report.