Security update for jetty-minimal
This update for jetty-minimal fixes the following issues: - Updated to version 9.4.53.v20231009: - CVE-2023-44487: Fixed a potential denial of service scenario via RST frame floods (bsc#1216169). - CVE-2023-36478: Fixed an integer overflow in the HTTP/2 HPACK decoder (bsc#1216162). - CVE-2023-40167: Fixed a permissive HTTP header parsing issue that could potentially lead to HTTP smuggling attacks (bsc#1215417). - CVE-2023-36479: Fixed an incorrect command execution when sending requests with certain characters in requested filenames (bsc#1215415). - CVE-2023-41900: Fixed an issue where an invalidated session would be allowed to perform a single request (bsc#1215416).
02 / AFFECTED SOFTWARE
Affected packages
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
This update for jetty-minimal fixes the following issues: - Updated to version 9.4.53.v20231009: - CVE-2023-44487: Fixed a potential denial of service scenario via RST frame floods (bsc#1216169). - CVE-2023-36478: Fixed an integer overflow in the HTTP/2 HPACK decoder (bsc#1216162). - CVE-2023-40167: Fixed a permissive HTTP header parsing issue that could potentially lead to HTTP smuggling attacks (bsc#1215417). - CVE-2023-36479: Fixed an incorrect command execution when sending requests with certain characters in requested filenames (bsc#1215415). - CVE-2023-41900: Fixed an issue where an invalidated session would be allowed to perform a single request (bsc#1215416).
05 / REFERENCES
Further evidence
- https://bugzilla.suse.com/1215415
- https://bugzilla.suse.com/1215416
- https://bugzilla.suse.com/1215417
- https://bugzilla.suse.com/1216162
- https://bugzilla.suse.com/1216169
- https://www.suse.com/security/cve/CVE-2023-36478
- https://www.suse.com/security/cve/CVE-2023-36479
- https://www.suse.com/security/cve/CVE-2023-40167
- https://www.suse.com/security/cve/CVE-2023-41900
- https://www.suse.com/security/cve/CVE-2023-44487
- https://www.suse.com/support/update/announcement/2023/suse-su-20234210-1/