org.eclipse.jetty:jetty-security 9.4.16.v20190411

Direct Vulnerabilities

Known vulnerabilities in the org.eclipse.jetty:jetty-security package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
M Incorrect Authorization Affected versions of this package are vulnerable to Incorrect Authorization in the `ConstraintSecurityHandler` process when HTTP method constraints are defined with `http-method-omission`. An attacker can gain unauthorized access by crafting requests that use substrings of the defined HTTP methods, thereby bypassing intended security restrictions. How to fix Incorrect Authorization? Upgrade `org.eclipse.jetty:jetty-security` to version 9.4.65, 10.0.33, 11.0.33 or higher.	[9.4.0-alpha0,9.4.65)[10.0.0-alpha0,10.0.33)[11.0.0-alpha0,11.0.33)
M Incorrect Authorization Affected versions of this package are vulnerable to Incorrect Authorization in the processing of security constraints when multiple constraints with identical `http-method-omission` sets and no `url-patterns` are present. An attacker can bypass intended security restrictions by crafting requests that exploit the improper combination of these constraints. How to fix Incorrect Authorization? Upgrade `org.eclipse.jetty:jetty-security` to version 9.4.65, 10.0.33, 11.0.33 or higher.	[7.6.13,9.4.65)[10.0.0,10.0.33)[11.0.0,11.0.33)
H Incorrect Implementation of Authentication Algorithm Affected versions of this package are vulnerable to Incorrect Implementation of Authentication Algorithm due to lossy ISO-8859-1 encoding in the digest hash computation. An attacker can log in as a user with a non-Latin-1 password by supplying a collision password that replaces each non-ASCII character with `?`, producing the same digest response hash. The vulnerable code feeds the username/password material into `getBytes(StandardCharsets.ISO_8859_1)` when computing the digest values, so characters above U+00FF are silently substituted before hashing. That lets an attacker authenticate successfully with a different password while the victim’s Digest-authenticated account accepts the forged response. How to fix Incorrect Implementation of Authentication Algorithm? Upgrade `org.eclipse.jetty:jetty-security` to version 9.4.63, 10.0.31, 11.0.31, 12.0.36, 12.1.10 or higher.	[9.4.0,9.4.63)[10.0.0,10.0.31)[11.0.0,11.0.31)[12.0.0,12.0.36)[12.1.0,12.1.10)

Vulnerability

Vulnerable Version

Incorrect Authorization

Affected versions of this package are vulnerable to Incorrect Authorization in the ConstraintSecurityHandler process when HTTP method constraints are defined with http-method-omission. An attacker can gain unauthorized access by crafting requests that use substrings of the defined HTTP methods, thereby bypassing intended security restrictions.

How to fix Incorrect Authorization?

Upgrade org.eclipse.jetty:jetty-security to version 9.4.65, 10.0.33, 11.0.33 or higher.

[9.4.0-alpha0,9.4.65)[10.0.0-alpha0,10.0.33)[11.0.0-alpha0,11.0.33)

Incorrect Authorization

Affected versions of this package are vulnerable to Incorrect Authorization in the processing of security constraints when multiple constraints with identical http-method-omission sets and no url-patterns are present. An attacker can bypass intended security restrictions by crafting requests that exploit the improper combination of these constraints.

How to fix Incorrect Authorization?

Upgrade org.eclipse.jetty:jetty-security to version 9.4.65, 10.0.33, 11.0.33 or higher.

[7.6.13,9.4.65)[10.0.0,10.0.33)[11.0.0,11.0.33)

Incorrect Implementation of Authentication Algorithm

Affected versions of this package are vulnerable to Incorrect Implementation of Authentication Algorithm due to lossy ISO-8859-1 encoding in the digest hash computation. An attacker can log in as a user with a non-Latin-1 password by supplying a collision password that replaces each non-ASCII character with ?, producing the same digest response hash. The vulnerable code feeds the username/password material into getBytes(StandardCharsets.ISO_8859_1) when computing the digest values, so characters above U+00FF are silently substituted before hashing. That lets an attacker authenticate successfully with a different password while the victim’s Digest-authenticated account accepts the forged response.

How to fix Incorrect Implementation of Authentication Algorithm?

Upgrade org.eclipse.jetty:jetty-security to version 9.4.63, 10.0.31, 11.0.31, 12.0.36, 12.1.10 or higher.

[9.4.0,9.4.63)[10.0.0,10.0.31)[11.0.0,11.0.31)[12.0.0,12.0.36)[12.1.0,12.1.10)

org.eclipse.jetty:jetty-security@9.4.16.v20190411

latest version

latest non vulnerable version

first published

latest version published

licenses detected

package registry

Direct Vulnerabilities

Fix vulnerabilities automatically