Vulnerability · Published Sep 15, 2023 · Assigned by GitHub_M
CVE-2023-36479Jetty vulnerable to errant command quoting in CGI Servlet
Low 3.5
In plain English
A low-severity security flaw in jetty.project from eclipse. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 67% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Eclipse Jetty Canonical Repository is the canonical repository for the Jetty project. Users of the CgiServlet with a very specific command structure may have the wrong command executed. If a user sends a request to a org.eclipse.jetty.servlets.CGI Servlet for a binary with a space in its name, the servlet will escape the command by wrapping it in quotation marks. This wrapped command, plus an optional command prefix, will then be executed through a call to Runtime.exec. If the original binary name provided by the user contains a quotation mark followed by a space, the resulting command line will contain multiple tokens instead of one. This issue was patched in version 9.4.52, 10.0.16, 11.0.16 and 12.0.0-beta2.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | jetty9 | 9.4.50-4+deb12u1 | DEBIAN-CVE-2023-36479 |
| Debian:12 | jetty9 | 9.4.50-4+deb12u1 | DSA-5507-1 |
| Debian:13 | jetty9 | 9.4.52-1 | DEBIAN-CVE-2023-36479 |
| Debian:14 | jetty9 | 9.4.52-1 | DEBIAN-CVE-2023-36479 |
| Maven | org.eclipse.jetty.ee10:jetty-ee10-servlets | 12.0.0-beta2 | GHSA-3gh6-v5v9-6v9j |
| Maven | org.eclipse.jetty.ee8:jetty-ee8-servlets | 12.0.0-beta2 | GHSA-3gh6-v5v9-6v9j |
| Maven | org.eclipse.jetty.ee9:jetty-ee9-servlets | 12.0.0-beta2 | GHSA-3gh6-v5v9-6v9j |
| Maven | org.eclipse.jetty:jetty-servlets | 9.4.52 | GHSA-3gh6-v5v9-6v9j |
| Maven | org.eclipse.jetty:jetty-servlets | 11.0.16 | GHSA-3gh6-v5v9-6v9j |
| Maven | org.eclipse.jetty:jetty-servlets | 10.0.16 | GHSA-3gh6-v5v9-6v9j |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| eclipse | jetty.project | >= 9.0.0, <= 9.4.51>= 10.0.0, <= 10.0.15>= 11.0.0, <= 11.0.15<= 12.0.0-beta1 |
Weakness: CWE-149 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N
References
- https://github.com/eclipse/jetty.project/security/advisories/GHSA-3gh6-v5v9-6v9j x_refsource_CONFIRM
- https://github.com/eclipse/jetty.project/pull/9516 x_refsource_MISC
- https://github.com/eclipse/jetty.project/pull/9888 x_refsource_MISC
- https://github.com/eclipse/jetty.project/pull/9889 x_refsource_MISC
- https://www.debian.org/security/2023/dsa-5507
- https://lists.debian.org/debian-lts-announce/2023/09/msg00039.html