[GitHub] [aurora] larrycameron80 opened a new issue #84: Information Exposure

[GitBox <gi...@apache.org>]

larrycameron80 opened a new issue #84: Information Exposure
URL: https://github.com/apache/aurora/issues/84
 
 
   Information Exposure
   Vulnerable module: org.eclipse.jetty:jetty-server
   Introduced through: org.eclipse.jetty:jetty-server@9.3.11.v20160721, org.eclipse.jetty:jetty-rewrite@9.3.11.v20160721 and others
   Detailed paths
   Introduced through: apache/aurora@apache/aurora#ea8e2f4d905e26b3b999e8b59a3cb74a08a3dbf5 › org.eclipse.jetty:jetty-server@9.3.11.v20160721
   Remediation: Upgrade to org.eclipse.jetty:jetty-server@9.3.27.v20190418.
   Introduced through: apache/aurora@apache/aurora#ea8e2f4d905e26b3b999e8b59a3cb74a08a3dbf5 › org.eclipse.jetty:jetty-rewrite@9.3.11.v20160721 › org.eclipse.jetty:jetty-server@9.3.11.v20160721
   Remediation: Upgrade to org.eclipse.jetty:jetty-rewrite@9.3.27.v20190418.
   Introduced through: apache/aurora@apache/aurora#ea8e2f4d905e26b3b999e8b59a3cb74a08a3dbf5 › org.eclipse.jetty:jetty-servlet@9.3.11.v20160721 › org.eclipse.jetty:jetty-security@9.3.11.v20160721 › org.eclipse.jetty:jetty-server@9.3.11.v20160721
   Remediation: Upgrade to org.eclipse.jetty:jetty-servlet@9.3.27.v20190418.
   Overview
   org.eclipse.jetty:jetty-server is a is a lightweight highly scalable java based web server and servlet engine.
   
   Affected versions of this package are vulnerable to Information Exposure. The configuration of a Jetty server may be leaked as part of a HTTP 404 response. This is due to the DefaultHandler class producing an error page during an exception.

----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
 
For queries about this service, please contact Infrastructure at:
users@infra.apache.org


With regards,
Apache Git Services