Improper resource shutdown or release in Jetty - CVE-2024-13009

Vulnerability identifier: #VU108837

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-13009

CWE-ID: CWE-404

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to an error in GzipHandler when handling certain URL paths. A remote attacker can send a specially crafted HTTP request to the affected server and force it to reveal a part of the request body in a separate request.

Jetty
SUSE Linux Enterprise Server 15 SP5
SUSE Linux Enterprise Server 15 SP3
SUSE Linux Enterprise Server 15 SP4
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
SUSE Enterprise Storage
SUSE Package Hub 15
Development Tools Module
openSUSE Leap
Anolis OS
Operations Analytics - Log Analysis
IBM Cloud Pak for Watson AIOps
Storage Protect Server
watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component
StreamSets Data Collector
webMethods BPM
Hybrid Cloud Observability
watsonx.data
IBM Cloud Pak System
Crowd Server
IBM Qradar SIEM
Netcool/OMNIbus
Bamboo Server
Enterprise Manager Base Platform
Oracle Middleware Common Libraries and Tools
UCD - IBM UrbanCode Deploy
JD Edwards EnterpriseOne Orchestrator
Identity Manager
Orion Platform
Oracle Unified Directory
AMQ Streams
Red Hat Camel for Spring Boot
jetty-client
jetty-continuation
jetty-io
jetty-jaas
jetty-javadoc
jetty-jmx
jetty-security
jetty-server
jetty-servlet
jetty-util
jetty-util-ajax
jetty-webapp
jetty-xml
jetty-http
jetty
jetty-proxy
jetty-servlets
jetty-deploy
jetty-jndi
jetty-rewrite
jetty-minimal-javadoc
jetty-start
jetty-jsp
jetty-fcgi
jetty-ant
jetty-http-spi
jetty-plus
jetty-cdi
jetty-openid
jetty-quickstart
jetty-annotations

Install updates from vendor's website.

Jetty - update to 9.4.57
Operations Analytics - Log Analysis - update to 1.3.8.4
watsonx.data - update to 2.2.1
IBM Cloud Pak System - update to 2.3.5.1
IBM Cloud Pak for Watson AIOps - update to 4.10.0
Crowd Server - update to 7.1.1
IBM Qradar SIEM - update to 7.5.0 Update Pack 14 IF02
Netcool/OMNIbus - update to 8.1.0.35
Storage Protect Server - update to 8.2.1
Bamboo Server - update to 9.6.15
Orion Platform - update to 2025.4.1
AMQ Streams - update to 2
Red Hat Camel for Spring Boot - update to 4.10.3
watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component - update to 5.2.1
StreamSets Data Collector - update to 7.0.0
UCD - IBM UrbanCode Deploy - addressed in versions 7.1.2.24, 7.2.3.17, 7.3.2.12
jetty-client - update to 9.4.43-3
jetty-continuation - update to 9.4.43-3
jetty-io - update to 9.4.43-3
jetty-jaas - update to 9.4.43-3
jetty-javadoc - update to 9.4.43-3
jetty-jmx - update to 9.4.43-3
jetty-security - update to 9.4.43-3
jetty-server - update to 9.4.43-3
jetty-servlet - update to 9.4.43-3
jetty-util - update to 9.4.43-3
jetty-util-ajax - update to 9.4.43-3
jetty-webapp - update to 9.4.43-3
jetty-xml - update to 9.4.43-3
jetty-http - update to 9.4.43-3
jetty - update to 9.4.43-3
jetty-proxy - update to 9.4.57-150200.3.31.1
jetty-servlet - update to 9.4.57-150200.3.31.1
jetty-util-ajax - update to 9.4.57-150200.3.31.1
jetty-io - update to 9.4.57-150200.3.31.1
jetty-http - update to 9.4.57-150200.3.31.1
jetty-security - update to 9.4.57-150200.3.31.1
jetty-server - update to 9.4.57-150200.3.31.1
jetty-servlets - update to 9.4.57-150200.3.31.1
jetty-deploy - update to 9.4.57-150200.3.31.1
jetty-continuation - update to 9.4.57-150200.3.31.1
jetty-jndi - update to 9.4.57-150200.3.31.1
jetty-rewrite - update to 9.4.57-150200.3.31.1
jetty-minimal-javadoc - update to 9.4.57-150200.3.31.1
jetty-start - update to 9.4.57-150200.3.31.1
jetty-jsp - update to 9.4.57-150200.3.31.1
jetty-fcgi - update to 9.4.57-150200.3.31.1
jetty-ant - update to 9.4.57-150200.3.31.1
jetty-util - update to 9.4.57-150200.3.31.1
jetty-http-spi - update to 9.4.57-150200.3.31.1
jetty-client - update to 9.4.57-150200.3.31.1
jetty-plus - update to 9.4.57-150200.3.31.1
jetty-webapp - update to 9.4.57-150200.3.31.1
jetty-jmx - update to 9.4.57-150200.3.31.1
jetty-cdi - update to 9.4.57-150200.3.31.1
jetty-xml - update to 9.4.57-150200.3.31.1
jetty-openid - update to 9.4.57-150200.3.31.1
jetty-quickstart - update to 9.4.57-150200.3.31.1
jetty-annotations - update to 9.4.57-150200.3.31.1
jetty-jaas - update to 9.4.57-150200.3.31.1
webMethods BPM - addressed in versions 10.15 Fix 15, 11.1 Fix 3
Hybrid Cloud Observability - update to 2025.4.1

• https://github.com/jetty/jetty.project/security/advisories/GHSA-q4rv-gq96-w7c5
• https://gitlab.eclipse.org/security/cve-assignement/-/issues/48

• Improper input validation in Jetty GzipHandler
• SUSE update for jetty-minimal
• Anolis OS update for jetty
• IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) update for Eclipse Jetty
• Multiple vulnerabilities in IBM Cloud Pak for AIOps
• Multiple vulnerabilities in AMQ Streams
• Multiple vulnerabilities in Red Hat Camel for Spring Boot 4.10
• Bamboo Data Center and Server update for Jetty
• IBM watsonx.data update for Eclipse Jetty
• IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component update for Eclipse Jetty
• Improper resource shutdown or release in JD Edwards EnterpriseOne Orchestrator
• Multiple vulnerabilities in SolarWinds Observability
• Multiple vulnerabilities in SolarWinds Platform
• IBM webMethods BPM update for Eclipse Jetty
• Multiple vulnerabilities in Tivoli Netcool/OMNIbus
• Multiple vulnerabilities in IBM StreamSets Data Collector
• Crowd Data Center and Server update for jackson-databind
• Multiple vulnerabilities in IBM QRadar SIEM
• Multiple vulnerabilities in Oracle Middleware Common Libraries and Tools
• Improper resource shutdown or release in Oracle Unified Directory
• Multiple vulnerabilities in Enterprise Manager Base Platform
• IBM Storage Protect Server update for Eclipse Jetty
• Multiple vulnerabilities in IBM Operations Analytics - Log Analysis
• Multiple vulnerabilities in Identity Manager
• Multiple vulnerabilities in IBM Cloud Pak System