Accepted jetty9 9.4.50-4+deb10u1 (source) into oldoldstable
- To: debian-lts-changes@lists.debian.org, dispatch@tracker.debian.org
- Subject: Accepted jetty9 9.4.50-4+deb10u1 (source) into oldoldstable
- From: Debian FTP Masters <ftpmaster@ftp-master.debian.org>
- Date: Mon, 30 Oct 2023 19:30:19 +0000
- Debian: DAK
- Debian-architecture: source
- Debian-archive-action: accept
- Debian-changes: jetty9_9.4.50-4+deb10u1_source.changes
- Debian-source: jetty9
- Debian-suite: oldoldstable
- Debian-version: 9.4.50-4+deb10u1
- Dkim-signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=ftp-master.debian.org; s=smtpauto.seger; h=Date:Message-Id: Content-Transfer-Encoding:Content-Type:Subject:MIME-Version:To:Reply-To:From: Cc:Content-ID:Content-Description:In-Reply-To:References; bh=duQVspkQU7CxOWXS4aoX8KpT2MdDJ87NHRQE1SJD7Ys=; b=HY1CnjCVO4draVsC8Z3MlSyIKA uf7dycaCmT7Hy3PulnBoCKPOzFATBPUQ7VobbV4xQUI0fSLMFEfJ0SunspEZYl2hXqctwIfyBbFwk a/0FrNr1ODCQydpSz3xqwE9QovkWDRuJjMBwXrO6lhFveDs7mw7Ufe2b5fqSjZeiZst5B+I9ggnYJ 1Oa/VAGMCAq/o/xpIdMldAscLGgz5iYenEklEamGjX/MNg5dp9i7I/CGwfTe5rJHtEXYX+eEmjzGf zwb3wmQHx/vz2GVcQkvyjuLcO/jLPyiBx3pnjk+z2HWYqOGO+dIrPbAd7PXpeBcxXGHvJopQpNFAi /J5gsDKw==;
- Mail-followup-to: debian-lts@lists.debian.org
- Message-id: <E1qxXxr-00E3z5-9R@seger.debian.org>
- Reply-to: debian-lts@lists.debian.org
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Mon, 30 Oct 2023 18:19:14 CET
Source: jetty9
Architecture: source
Version: 9.4.50-4+deb10u1
Distribution: buster-security
Urgency: high
Maintainer: Debian Java Maintainers <pkg-java-maintainers@lists.alioth.debian.org>
Changed-By: Markus Koschany <apo@debian.org>
Checksums-Sha1:
4c6b56a7ac350de3186eb3c538dbfb5d6062101f 2779 jetty9_9.4.50-4+deb10u1.dsc
3804e02da535f6e62272ae6834bad323b74f17a9 81472 jetty9_9.4.50-4+deb10u1.debian.tar.xz
36155f52e6dafed60af1d2dbc1036819fc032a98 17839 jetty9_9.4.50-4+deb10u1_amd64.buildinfo
Checksums-Sha256:
1c1fda24933ef2d4b88c158b8fede28f09231b334a68b0a30b2b717394511a23 2779 jetty9_9.4.50-4+deb10u1.dsc
0c19525f38ad12114da0f3b91eb278390c863c9e48589d4798d9e5f866c49e9b 81472 jetty9_9.4.50-4+deb10u1.debian.tar.xz
0069f49ed49e16c0d277945c7fc6ce732acef288e807b60d007b19b4d299cfb6 17839 jetty9_9.4.50-4+deb10u1_amd64.buildinfo
Changes:
jetty9 (9.4.50-4+deb10u1) buster-security; urgency=high
.
* Team upload.
* Backport Jetty 9 version from Bookworm.
* Revert to compat level 12 and servlet-api 3.1.
* Fix CVE-2023-36478 and CVE-2023-44487:
Two remotely exploitable security vulnerabilities were discovered in Jetty
9, a Java based web server and servlet engine. The HTTP/2 protocol
implementation did not sufficiently verify if HPACK header values exceed
their size limit. Furthermore the HTTP/2 protocol allowed a denial of
service (server resource consumption) because request cancellation can
reset many streams quickly. This problem is also known as Rapid Reset
Attack.
* Fix CVE-2020-27218:
If GZIP request body inflation is enabled and requests from different
clients are multiplexed onto a single connection, and if an attacker can
send a request with a body that is received entirely but not consumed by
the application, then a subsequent request on the same connection will see
that body prepended to its body. The attacker will not see any data but may
inject data into the body of the subsequent request.
Files:
91c5e2625ebe6cdf4a98c331fc238137 2779 java optional jetty9_9.4.50-4+deb10u1.dsc
537da7b127f4c3f17a22bab056338c90 81472 java optional jetty9_9.4.50-4+deb10u1.debian.tar.xz
2faa413f0d64bf7a389ec565e3d910f3 17839 java optional jetty9_9.4.50-4+deb10u1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQKjBAEBCgCNFiEErPPQiO8y7e9qGoNf2a0UuVE7UeQFAmVAAW9fFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEFD
RjNEMDg4RUYzMkVERUY2QTFBODM1RkQ5QUQxNEI5NTEzQjUxRTQPHGFwb0BkZWJp
YW4ub3JnAAoJENmtFLlRO1HkG6EQAKm5uqdmnB3OYelcjZSeDKR0dUrLoA/oVMkK
23G9CIIs6VKH8qIY1kI5WVrbIfbu9O05Y7GWf4Wzpn1ohrH3hFuaD8OtbIuOdrc2
MI8rsxoMOSo/Hp9IOa74V19GXkhMrZvqZGjO3SHMNyZgkHVL9cwGWzsxyVy0JKoI
vP/mg5yPQ/iFe7OTibj/8GXaXfZQbXIbJnd1GkMRiTj//6JlM6TY/BHusx14YB4Z
kTkYLfqjs7thuCbYJG566XKk4rjwvkhAjzRabGQNU253HD6+mCeJAv9dvgIsxM/g
s+vFUDoJQzk3cn/ybgzaEVeFxEVovuzizxN/7R1QclHgKc9cjIolzjBL6My4EPGQ
zkCr+T/TW0nFYaNHmSgIWvAWmye/n06QlNvH1uXPlJA4Htoz2sodqfKJpalHUdUm
4Ub+fEEdp2EZZcQNMsdGCkqaJE+tH1ZuNhE6sfc6F2jiv5n1PaEYkhqVB7W3oBFV
e2WYrgSYMFHOtN+H75QA/+0KbsjTNsgv9XJHgnpwFEM2KYelk12ENGRXd70HKifY
GTrTQuUCYJAEIBQZ33ns7lmg4hPd1T1hh/kSXJWJbydSvFSl/QjW8n5b49eGfQu0
GwpNncUZOmfz9aTqtsRC6c6lBkgVqlGyCdH5F7l1VJO6JfrzRXbzWqVSWjdPzWLu
B9utIbzw
=EBqD
-----END PGP SIGNATURE-----