org.eclipse.jetty:jetty-security 12.1.5

Direct Vulnerabilities

Known vulnerabilities in the org.eclipse.jetty:jetty-security package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
C Authentication Bypass Using an Alternate Path or Channel Affected versions of this package are vulnerable to Authentication Bypass Using an Alternate Path or Channel in the `EthereumAuthenticator` process. An attacker can gain unauthorized access to protected resources by crafting a request path that includes the configured login path as a later segment. This is only exploitable if the protected resource path contains the configured login path as a subsequent segment; explicitly forbidden routes are not affected. How to fix Authentication Bypass Using an Alternate Path or Channel? Upgrade `org.eclipse.jetty:jetty-security` to version 12.1.13 or higher.	[12.1.0-alpha0,12.1.13)
H Incorrect Implementation of Authentication Algorithm Affected versions of this package are vulnerable to Incorrect Implementation of Authentication Algorithm due to lossy ISO-8859-1 encoding in the digest hash computation. An attacker can log in as a user with a non-Latin-1 password by supplying a collision password that replaces each non-ASCII character with `?`, producing the same digest response hash. The vulnerable code feeds the username/password material into `getBytes(StandardCharsets.ISO_8859_1)` when computing the digest values, so characters above U+00FF are silently substituted before hashing. That lets an attacker authenticate successfully with a different password while the victim’s Digest-authenticated account accepts the forged response. How to fix Incorrect Implementation of Authentication Algorithm? Upgrade `org.eclipse.jetty:jetty-security` to version 9.4.63, 10.0.31, 11.0.31, 12.0.36, 12.1.10 or higher.	[9.4.0,9.4.63)[10.0.0,10.0.31)[11.0.0,11.0.31)[12.0.0,12.0.36)[12.1.0,12.1.10)

Vulnerability

Vulnerable Version

Authentication Bypass Using an Alternate Path or Channel

Affected versions of this package are vulnerable to Authentication Bypass Using an Alternate Path or Channel in the EthereumAuthenticator process. An attacker can gain unauthorized access to protected resources by crafting a request path that includes the configured login path as a later segment. This is only exploitable if the protected resource path contains the configured login path as a subsequent segment; explicitly forbidden routes are not affected.

How to fix Authentication Bypass Using an Alternate Path or Channel?

Upgrade org.eclipse.jetty:jetty-security to version 12.1.13 or higher.

[12.1.0-alpha0,12.1.13)

Incorrect Implementation of Authentication Algorithm

Affected versions of this package are vulnerable to Incorrect Implementation of Authentication Algorithm due to lossy ISO-8859-1 encoding in the digest hash computation. An attacker can log in as a user with a non-Latin-1 password by supplying a collision password that replaces each non-ASCII character with ?, producing the same digest response hash. The vulnerable code feeds the username/password material into getBytes(StandardCharsets.ISO_8859_1) when computing the digest values, so characters above U+00FF are silently substituted before hashing. That lets an attacker authenticate successfully with a different password while the victim’s Digest-authenticated account accepts the forged response.

How to fix Incorrect Implementation of Authentication Algorithm?

Upgrade org.eclipse.jetty:jetty-security to version 9.4.63, 10.0.31, 11.0.31, 12.0.36, 12.1.10 or higher.

[9.4.0,9.4.63)[10.0.0,10.0.31)[11.0.0,11.0.31)[12.0.0,12.0.36)[12.1.0,12.1.10)

org.eclipse.jetty:jetty-security@12.1.5

latest version

latest non vulnerable version

first published

latest version published

licenses detected

package registry

Direct Vulnerabilities

Fix vulnerabilities automatically