https://bugzilla.redhat.com/show_bug.cgi?id=1196254 Bug ID: 1196254 Summary: CVE-2015-2080 jetty: remote unauthenticated credential exposure Product: Security Response Component: vulnerability Keywords: Security Severity: high Priority: high Assignee: security-response-team(a)redhat.com Reporter: vkaigoro(a)redhat.com CC: atangrin(a)redhat.com, bleanhar(a)redhat.com, ccoleman(a)redhat.com, cperry(a)redhat.com, dmcphers(a)redhat.com, eclipse-sig(a)lists.fedoraproject.org, java-maint(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jdetiber(a)redhat.com, jialiu(a)redhat.com, jkeck(a)redhat.com, jokerman(a)redhat.com, krzysztof.daniel(a)gmail.com, kseifried(a)redhat.com, lmeyer(a)redhat.com, mizdebsk(a)redhat.com, mkollar(a)redhat.com, mmccomas(a)redhat.com, msimacek(a)redhat.com, msrb(a)redhat.com, overholt(a)gmail.com, pmackinn(a)redhat.com, taw(a)redhat.com, tjay(a)redhat.com CVE-2015-2080 has been assigned to this issue in which Jetty sends an HTTP response to one client containing HTTP request data from a different client: External References: http://dev.eclipse.org/mhonarc/lists/jetty-announce/msg00074.html https://github.com/eclipse/jetty.project/blob/master/advisories/2015-02-2... http://blog.gdssecurity.com/labs/2015/2/25/jetleak-vulnerability-remote-l... Statement: This issue did not affect the versions of jetty as shipped with Red Hat Enterprise Linux 7, versions of openshift-origin-cartridge-fuse as shipped with Red Hat OpenShift Enterprise 2.1, and versions of nutch as shipped with Red Hat Satellite 5. -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=5urGpD4iWp&a=cc_unsubscribe