Bug#393073: jetty should not reenter testing until some security
issues have been checked
sf at sfritsch.de
Sat Oct 14 20:17:07 UTC 2006
Some security issues have been found in jetty 6:
jetty 6.0.x (jetty6) beta16 allows remote attackers to read
arbitrary script source code via a capital P in the .jsp extension,
and probably other mixed case manipulations.
Directory traversal vulnerability in jetty 6.0.x (jetty6) beta16
allows remote attackers to read arbitrary files via a %2e%2e%5c
(encoded ../) in the URL.
A request to the maintainers to verify that they are not in present in
jetty 5 has not been answered. Jetty should not reenter testing until
these issues are checked.
PS: The changes file of 5.1.10-2 was quite broken, some of the bugs were
not marked as closed.
More information about the pkg-java-maintainers