DSA-5540: -1 jetty9 -- security update
jetty9 - security update
Other sources
Two remotely exploitable security vulnerabilities were discovered in Jetty 9, a Java based web server and servlet engine. The HTTP/2 protocol implementation did not sufficiently verify if HPACK header values exceed their size limit. Furthermore the HTTP/2 protocol allowed a denial of service (server resource consumption) because request cancellation can reset many streams quickly. This problem is also known as Rapid Reset Attack.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/jetty9to a version that resolves this vulnerability.Fixed in 9.4.57-1.1~deb12u1 - Upgrade
Upgrade
jetty9to a version that resolves this vulnerability.Patch DSA-5540-1
Event History
Frequently Asked Questions
What is the vulnerability ID for this security update?
The vulnerability ID for this security update is DSA-5540.
What is Jetty 9?
Jetty 9 is a Java based web server and servlet engine.
What are the affected software packages?
The affected software package is Jetty 9.
What are the CVE identifiers associated with this vulnerability?
The CVE identifiers associated with this vulnerability are CVE-2023-36478 and CVE-2023-44487.
Where can I find more information about this security update?
More information about this security update can be found at the Debian Security Tracker: https://www.debian.org/security/2023/dsa-5540