2 lines
20 KiB
JSON
2 lines
20 KiB
JSON
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Eclipse Jetty","repo":"https://github.com/jetty/jetty.project","vendor":"Eclipse Foundation","versions":[{"lessThanOrEqual":"12.0.31","status":"affected","version":"12.0.0","versionType":"semver"},{"lessThanOrEqual":"12.1.5","status":"affected","version":"12.1.0.","versionType":"semver"}]}],"source":"emo@eclipse.org"},{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:apache_camel_hawtio:4.4::el9"],"defaultStatus":"unaffected","packageName":"jetty-server","product":"HawtIO HawtIO 4.4.0","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:amq_broker:7.14"],"defaultStatus":"unaffected","packageName":"jetty-server","product":"Red Hat AMQ Broker 7.14.0","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"],"defaultStatus":"unaffected","packageName":"jetty-server","product":"Red Hat JBoss Enterprise Application Platform 8.1","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8"],"defaultStatus":"affected","packageName":"eap8-activemq-artemis","product":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:2.40.0-7.redhat_00015.1.el8eap","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8"],"defaultStatus":"affected","packageName":"eap8-eap-product-conf-parent","product":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:801.6.1-1.GA_redhat_00001.1.el8eap","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8"],"defaultStatus":"affected","packageName":"eap8-undertow","product":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:2.3.24-3.SP2_redhat_00001.1.el8eap","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8"],"defaultStatus":"affected","packageName":"eap8-wildfly","product":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:8.1.6-7.GA_redhat_00010.1.el8eap","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"],"defaultStatus":"affected","packageName":"eap8-activemq-artemis","product":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:2.40.0-7.redhat_00015.1.el9eap","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"],"defaultStatus":"affected","packageName":"eap8-eap-product-conf-parent","product":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:801.6.1-1.GA_redhat_00001.1.el9eap","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"],"defaultStatus":"affected","packageName":"eap8-undertow","product":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:2.3.24-3.SP2_redhat_00001.1.el9eap","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"],"defaultStatus":"affected","packageName":"eap8-wildfly","product":"Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:8.1.6-7.GA_redhat_00010.1.el9eap","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:ocp_tools:4.12::el8"],"defaultStatus":"affected","packageName":"ocp-tools-4/jenkins-rhel8","product":"OpenShift Developer Tools and Services 4.12","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1786628667","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:ocp_tools:4.13::el8"],"defaultStatus":"affected","packageName":"ocp-tools-4/jenkins-rhel8","product":"OpenShift Developer Tools and Services 4.13","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1786628681","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:ocp_tools:4.14::el8"],"defaultStatus":"affected","packageName":"ocp-tools-4/jenkins-rhel8","product":"OpenShift Developer Tools and Services 4.14","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1786533561","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:ocp_tools:4.15::el8"],"defaultStatus":"affected","packageName":"ocp-tools-4/jenkins-rhel8","product":"OpenShift Developer Tools and Services 4.15","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1786533565","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:ocp_tools:4.16::el9"],"defaultStatus":"affected","packageName":"ocp-tools-4/jenkins-rhel9","product":"OpenShift Developer Tools and Services 4.16","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1787125166","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:ocp_tools:4.17::el9"],"defaultStatus":"affected","packageName":"ocp-tools-4/jenkins-rhel9","product":"OpenShift Developer Tools and Services 4.17","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1787124635","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:ocp_tools:4.18::el9"],"defaultStatus":"affected","packageName":"ocp-tools-4/jenkins-rhel9","product":"OpenShift Developer Tools and Services 4.18","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1787125069","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:ocp_tools:4.19::el9"],"defaultStatus":"affected","packageName":"ocp-tools-4/jenkins-rhel9","product":"OpenShift Developer Tools and Services 4.19","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1787124632","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:ocp_tools:4.20::el9"],"defaultStatus":"affected","packageName":"ocp-tools-4/jenkins-rhel9","product":"OpenShift Developer Tools and Services 4.20","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1787124925","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:ocp_tools:4.21::el9"],"defaultStatus":"affected","packageName":"ocp-tools-4/jenkins-rhel9","product":"OpenShift Developer Tools and Services 4.21","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1787125311","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:ocp_tools:4.22::el9"],"defaultStatus":"affected","packageName":"ocp-tools-4/jenkins-rhel9","product":"OpenShift Developer Tools and Services 4.22","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1787124779","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_devspaces:3.28::el9"],"defaultStatus":"affected","packageName":"devspaces/openvsx-rhel9","product":"Red Hat OpenShift Dev Spaces 3.28","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1779528224","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_devspaces:3.28::el9"],"defaultStatus":"affected","packageName":"devspaces/pluginregistry-rhel9","product":"Red Hat OpenShift Dev Spaces 3.28","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1779359423","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ocp_tools"],"defaultStatus":"affected","packageName":"jenkins","product":"OpenShift Developer Tools and Services","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:camel_spring_boot:4"],"defaultStatus":"unaffected","packageName":"jetty-server","product":"Red Hat build of Apache Camel for Spring Boot 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:service_registry:2"],"defaultStatus":"unaffected","packageName":"jetty-server","product":"Red Hat build of Apicurio Registry 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:apicurio_registry:3"],"defaultStatus":"unaffected","packageName":"jetty-server","product":"Red Hat build of Apicurio Registry 3","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:debezium:2"],"defaultStatus":"unaffected","packageName":"jetty-server","product":"Red Hat build of Debezium 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:debezium:3"],"defaultStatus":"unaffected","packageName":"jetty-server","product":"Red Hat build of Debezium 3","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_data_grid:8"],"defaultStatus":"unaffected","packageName":"jetty-server","product":"Red Hat Data Grid 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"],"defaultStatus":"unaffected","packageName":"maven-wagon","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"],"defaultStatus":"unaffected","packageName":"pki-core:10.6/resteasy","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"],"defaultStatus":"unaffected","packageName":"pki-deps:10.6/resteasy","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"],"defaultStatus":"unaffected","packageName":"jmc","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"],"defaultStatus":"unaffected","packageName":"resteasy","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_fuse:7"],"defaultStatus":"unaffected","packageName":"jetty-server","product":"Red Hat Fuse 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7"],"defaultStatus":"unaffected","packageName":"jetty-server","product":"Red Hat JBoss Enterprise Application Platform 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jbosseapxp"],"defaultStatus":"unaffected","packageName":"jetty-server","product":"Red Hat JBoss Enterprise Application Platform Expansion Pack","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_web_server:6"],"defaultStatus":"unaffected","packageName":"jetty-server","product":"Red Hat JBoss Web Server 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:offline_knowledge_portal:1"],"defaultStatus":"unaffected","packageName":"offline-knowledge-portal/rhokp-rhel9","product":"Red Hat Offline Knowledge Portal","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_bpms_platform:7"],"defaultStatus":"unaffected","packageName":"jetty-server","product":"Red Hat Process Automation 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6"],"defaultStatus":"unaffected","packageName":"puppetserver","product":"Red Hat Satellite 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6"],"defaultStatus":"unaffected","packageName":"satellite-capsule:el8/puppetserver","product":"Red Hat Satellite 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:red_hat_single_sign_on:7"],"defaultStatus":"unaffected","packageName":"jetty-server","product":"Red Hat Single Sign-On 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:amq_streams:2"],"defaultStatus":"unaffected","packageName":"jetty-server","product":"streams for Apache Kafka 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:amq_streams:3"],"defaultStatus":"unaffected","packageName":"jetty-server","product":"streams for Apache Kafka 3","vendor":"Red Hat"}],"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*","matchCriteriaId":"5773AE1D-15DA-44B0-BB9D-A8D9F3C29D21","versionEndExcluding":"12.0.32","versionStartIncluding":"12.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*","matchCriteriaId":"74198EA2-3D92-4676-A49F-59DCCB4DEB04","versionEndExcluding":"12.1.6","versionStartIncluding":"12.1.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Eclipse Jetty, versions 12.0.0-12.0.31 and 12.1.0-12.0.5, class GzipHandler exposes a vulnerability when a compressed HTTP request, with Content-Encoding: gzip, is processed and the corresponding response is not compressed.\n\n\nThis happens because the JDK Inflater is allocated for decompressing the request, but it is not released because the release mechanism is tied to the compressed response.\nIn this case, since the response is not compressed, the release mechanism does not trigger, causing the leak."},{"lang":"es","value":"En Eclipse Jetty, versiones 12.0.0-12.0.31 y 12.1.0-12.0.5, la clase GzipHandler expone una vulnerabilidad cuando una solicitud HTTP comprimida, con Content-Encoding: gzip, es procesada y la respuesta correspondiente no está comprimida.\n\nEsto ocurre porque el Inflater del JDK es asignado para descomprimir la solicitud, pero no es liberado porque el mecanismo de liberación está ligado a la respuesta comprimida.\nEn este caso, dado que la respuesta no está comprimida, el mecanismo de liberación no se activa, causando la fuga."}],"id":"CVE-2026-1605","lastModified":"2026-08-27T13:16:57.520","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"emo@eclipse.org","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-1605","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-03-05T14:46:07.126962Z","version":"2.0.3"}}]},"published":"2026-03-05T10:15:56.890","references":[{"source":"emo@eclipse.org","tags":["Vendor Advisory"],"url":"https://github.com/jetty/jetty.project/security/advisories/GHSA-xxh7-fcf3-rj7f"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:21772"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:25089"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:25125"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:25126"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:60239"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:60246"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:60247"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:60248"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:60249"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:60250"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:60251"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:60252"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:60254"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:60256"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:60259"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:8509"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/security/cve/CVE-2026-1605"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2444815"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-1605.json"}],"sourceIdentifier":"emo@eclipse.org","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-400"},{"lang":"en","value":"CWE-401"}],"source":"emo@eclipse.org","type":"Secondary"},{"description":[{"lang":"en","value":"CWE-401"}],"source":"nvd@nist.gov","type":"Secondary"},{"description":[{"lang":"en","value":"CWE-772"}],"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}
|