Input validation error in Jetty - CVE-2023-26049

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU75217

Input validation error in Jetty - CVE-2023-26049

Published: April 18, 2023 / Updated: November 28, 2023


Vulnerability identifier: #VU75217
CSH Severity: Low
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-26049
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to insufficient input validation when parsing cookies. A remote attacker can send a specially crafted HTTP request with a cookie value that starts with a double quote and force the application to read the cookie string until it sees a closing quote. Such behavior can be used to exfiltrate sensitive values from other cookies.


Affected software

Jetty
IBM Business Automation Workflow
IBM Process Mining
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Watson Knowledge Catalog in Cloud Pak for Data
IBM Sterling B2B Integrator
IBM Sterling Control Center
Red Hat Satellite
Oracle Financial Services Model Management and Governance
IBM Integration Bus
Oracle Communications Cloud Native Core Binding Support Function
Oracle Communications Network Analytics Data Director
Oracle Communications Cloud Native Core Network Repository Function
IBM Cloud Pak for Data System
Log Analysis
IBM MaaS360 Mobile Enterprise Gateway
IBM Sterling External Authentication Server
IBM Sterling Secure Proxy
IBM Sterling Connect:Direct Web Services
IBM Maximo Asset Management
Maximo Manage Application in IBM Maximo Application Suite
IBM Maximo Application Suite
IBM MQ
Rational Functional Tester (RFT)
Rational Service Tester
IBM Cloud Pak for Business Automation
Debian Linux
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Desktop 15
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
Red Hat Enterprise Linux for x86_64
Development Tools Module
openSUSE Leap
IBM Data Risk Manager
Rational Change
Oracle Banking Trade Finance Process Management
Oracle Banking Credit Facilities Process Management
Oracle Banking Virtual Account Management
Oracle Banking Liquidity Management
Oracle Banking Supply Chain Finance
Oracle Banking Origination
Oracle Banking Electronic Data Exchange for Corporates
Oracle Banking Cash Management
IBM Integrated Analytics System
Sterling Connect:Direct Browser User Interface
Tivoli Network Manager IP Edition
Cognos Dashboards on Cloud Pak for Data
DataStage on Cloud Pak for Data
Rational Synergy
InfoSphere Data Architect
Rational Performance Tester
DevOps Test Performance
Oracle Data Integrator
IBM Application Suite - IBM Asset Data Dictionary Component
Cloud Pak for Network Automation
DB2 on Cloud Pak for Data
DB2 Warehouse on Cloud Pak for Data
Storage Resource Manager
User Entity Behavior Analytics
IBM Enterprise Records
StreamSets Data Collector
IBM Engineering Systems Design Rhapsody
webMethods BPM
OpenShift Developer Tools and Services
IBM App Connect Enterprise
Oracle REST Data Services
Red Hat Camel for Spring Boot
JBoss Enterprise Application Platform
Oracle Coherence
AMQ Streams
JBoss Enterprise Application Platform expansion pack (EAP XP)
IBM Qradar SIEM
Juniper Secure Analytics (JSA)
Red Hat Single Sign-On
Oracle Retail EFTLink
Oracle Communications Cloud Native Core Policy
Oracle Communications Cloud Native Core Console
eap7-jboss-jsp (Red Hat package)
satellite-convert2rhel-toolkit (Red Hat package)
eap7-yasson (Red Hat package)
eap7-wildfly-transaction-client (Red Hat package)
eap7-jboss-server-migration (Red Hat package)
eap7-avro (Red Hat package)
rubygem-grpc (Red Hat package)
eap7-jboss-marshalling (Red Hat package)
mosquitto (Red Hat package)
eap7-undertow (Red Hat package)
eap7-jandex (Red Hat package)
eap7-apache-sshd (Red Hat package)
python-pulp-container (Red Hat package)
eap7-activemq-artemis (Red Hat package)
jenkins (Red Hat package)
eap7-weld-core (Red Hat package)
eap7-hal-console (Red Hat package)
foreman-installer (Red Hat package)
foreman (Red Hat package)
eap7-jboss-xnio-base (Red Hat package)
rubygem-google-protobuf (Red Hat package)
eap7-jgroups (Red Hat package)
candlepin (Red Hat package)
rubygem-katello (Red Hat package)
jenkins-2-plugins (Red Hat package)
eap7-hibernate (Red Hat package)
eap7-jbossws-cxf (Red Hat package)
rubygem-puma (Red Hat package)
rubygem-sidekiq (Red Hat package)
satellite (Red Hat package)
rubygem-kafo (Red Hat package)
eap7-wildfly (Red Hat package)
puppetserver (Red Hat package)
puppet-agent (Red Hat package)
jetty9 (Debian package)
jetty-minimal-javadoc
jetty-openid
jetty-annotations
jetty-servlets
jetty-jaas
jetty-jmx
jetty-rewrite
jetty-fcgi
jetty-servlet
jetty-ant
jetty-cdi
jetty-util-ajax
jetty-io
jetty-server
jetty-deploy
jetty-util
jetty-xml
jetty-continuation
jetty-http-spi
jetty-quickstart
jetty-http
jetty-security
jetty-client
jetty-start
jetty-plus
jetty-jsp
jetty-webapp
jetty-jndi
jetty-proxy
eap7-infinispan (Red Hat package)
rh-sso7-keycloak (Red Hat package)
rubygem-foreman_bootdisk (Red Hat package)
eap7-guava-libraries (Red Hat package)
watsonx.data
IBM MaaS360 VPN Module
Dell EMC Storage Monitoring and Reporting (SMR)
Operational Decision Manager
IBM Cognos Analytics
IBM InfoSphere Information Server

How to mitigate CVE-2023-26049

Install updates from vendor's website.

Jetty - addressed in versions 9.4.51.v20230217, 10.0.14, 11.0.14
IBM Process Mining - update to 1.14.2
IBM Data Risk Manager - update to 2.0.6.18
IBM Watson Discovery for IBM Cloud Pak for Data - update to 4.8.0
Tivoli Network Manager IP Edition - update to 4.2.0.20
Cognos Dashboards on Cloud Pak for Data - update to 4.8.0
DataStage on Cloud Pak for Data - update to 5.0.0
IBM Watson Knowledge Catalog in Cloud Pak for Data - addressed in versions 4.8.9, 5.1.3
Rational Change - update to 5.3.2.6
IBM Sterling B2B Integrator - addressed in versions 6.0.3.9, 6.1.0.8, 6.1.2.4, 6.2.0.0
IBM Sterling Control Center - update to 6.2.1.0.15
Red Hat Satellite - update to 6.14.2
Rational Synergy - update to 7.2.2.6
JBoss Enterprise Application Platform - update to 7.4.14
IBM Qradar SIEM - addressed in versions 7.5.0 Update Pack 7, 7.5.0 Update Pack 7 IF03
Juniper Secure Analytics (JSA) - update to 7.5.0 UP7 IF03
Red Hat Single Sign-On - update to 7.6.7
InfoSphere Data Architect - update to 9.2.1
IBM Integration Bus - update to 10.1.0.2
DevOps Test Performance - update to 11.0.8
Oracle REST Data Services - update to 23.2.2
eap7-jboss-jsp (Red Hat package) - addressed in versions api_2.3_spec-2.0.1-1.Final_redhat_00001.1.el7eap, api_2.3_spec-2.0.1-1.Final_redhat_00001.1.el8eap, api_2.3_spec-2.0.1-1.Final_redhat_00001.1.el9eap
satellite-convert2rhel-toolkit (Red Hat package) - update to 1.0.1-1.el8sat
IBM Cloud Pak for Data System - update to 1.0.8.2
eap7-yasson (Red Hat package) - addressed in versions 1.0.11-4.redhat_00002.1.el7eap, 1.0.11-4.redhat_00002.1.el8eap, 1.0.11-4.redhat_00002.1.el9eap
IBM Integrated Analytics System - update to 1.0.28.1
IBM Application Suite - IBM Asset Data Dictionary Component - update to 1.1.15
eap7-wildfly-transaction-client (Red Hat package) - addressed in versions 1.1.16-1.Final_redhat_00001.1.el7eap, 1.1.16-1.Final_redhat_00001.1.el8eap, 1.1.16-1.Final_redhat_00001.1.el9eap
Log Analysis - update to 1.3.8 Fix Pack 1
Sterling Connect:Direct Browser User Interface - update to 1.5.0.2 iFix-37
eap7-jboss-server-migration (Red Hat package) - addressed in versions 1.10.0-33.Final_redhat_00032.1.el7eap, 1.10.0-33.Final_redhat_00032.1.el8eap, 1.10.0-33.Final_redhat_00032.1.el9eap
eap7-avro (Red Hat package) - addressed in versions 1.11.3-1.redhat_00001.1.el7eap, 1.11.3-1.redhat_00001.1.el8eap, 1.11.3-1.redhat_00001.1.el9eap
rubygem-grpc (Red Hat package) - update to 1.58.0-1.el8sat
watsonx.data - update to 2.0.3
eap7-jboss-marshalling (Red Hat package) - addressed in versions 2.0.14-1.SP1_redhat_00001.1.el7eap, 2.0.14-1.SP1_redhat_00001.1.el8eap, 2.0.14-1.SP1_redhat_00001.1.el9eap
mosquitto (Red Hat package) - update to 2.0.17-1.el8sat
eap7-undertow (Red Hat package) - addressed in versions 2.2.28-1.SP1_redhat_00001.1.el7eap, 2.2.28-1.SP1_redhat_00001.1.el8eap, 2.2.28-1.SP1_redhat_00001.1.el9eap
eap7-jandex (Red Hat package) - addressed in versions 2.4.4-1.Final_redhat_00001.1.el7eap, 2.4.4-1.Final_redhat_00001.1.el8eap, 2.4.4-1.Final_redhat_00001.1.el9eap
AMQ Streams - update to 2.5.0
Cloud Pak for Network Automation - update to 2.7
eap7-apache-sshd (Red Hat package) - addressed in versions 2.9.3-1.redhat_00001.1.el7eap, 2.9.3-1.redhat_00001.1.el8eap, 2.9.3-1.redhat_00001.1.el9eap
python-pulp-container (Red Hat package) - update to 2.14.11-1.el8pc
eap7-activemq-artemis (Red Hat package) - addressed in versions 2.16.0-17.redhat_00051.1.el7eap, 2.16.0-17.redhat_00051.1.el8eap, 2.16.0-17.redhat_00051.1.el9eap
jenkins (Red Hat package) - update to 2.426.3.1706515686-3.el8
IBM MaaS360 Mobile Enterprise Gateway - update to 3.000.200
IBM MaaS360 VPN Module - update to 3.000.200
eap7-weld-core (Red Hat package) - addressed in versions 3.1.10-2.Final_redhat_00001.1.el7eap, 3.1.10-2.Final_redhat_00001.1.el8eap, 3.1.10-2.Final_redhat_00001.1.el9eap
eap7-hal-console (Red Hat package) - addressed in versions 3.3.20-1.Final_redhat_00001.1.el7eap, 3.3.20-1.Final_redhat_00001.1.el8eap, 3.3.20-1.Final_redhat_00001.1.el9eap
foreman-installer (Red Hat package) - update to 3.7.0.7-1.el8sat
foreman (Red Hat package) - update to 3.7.0.11-2.el8sat
eap7-jboss-xnio-base (Red Hat package) - addressed in versions 3.8.11-1.SP1_redhat_00001.1.el7eap, 3.8.11-1.SP1_redhat_00001.1.el8eap, 3.8.11-1.SP1_redhat_00001.1.el9eap
rubygem-google-protobuf (Red Hat package) - update to 3.24.3-1.el8sat
Red Hat Camel for Spring Boot - update to 4.0.0
JBoss Enterprise Application Platform expansion pack (EAP XP) - update to 4.0.2.GA
eap7-jgroups (Red Hat package) - addressed in versions 4.2.23-1.Final_redhat_00001.1.el7eap, 4.2.23-1.Final_redhat_00001.1.el8eap, 4.2.23-1.Final_redhat_00001.1.el9eap
candlepin (Red Hat package) - update to 4.3.11-1.el8sat
DB2 on Cloud Pak for Data - update to 4.8.2
DB2 Warehouse on Cloud Pak for Data - update to 4.8.2
rubygem-katello (Red Hat package) - update to 4.9.0.21-1.el8sat
Dell EMC Storage Monitoring and Reporting (SMR) - update to 4.10.0.3
Storage Resource Manager - update to 4.10.0.3
jenkins-2-plugins (Red Hat package) - update to 4.12.1706515741-1.el8
User Entity Behavior Analytics - update to 5.0.2
IBM Enterprise Records - update to 5.2.1.8 IF004
eap7-hibernate (Red Hat package) - addressed in versions 5.3.32-1.Final_redhat_00001.1.el7eap, 5.3.32-1.Final_redhat_00001.1.el8eap, 5.3.32-1.Final_redhat_00001.1.el9eap
eap7-jbossws-cxf (Red Hat package) - addressed in versions 5.4.9-1.Final_redhat_00001.1.el7eap, 5.4.9-1.Final_redhat_00001.1.el8eap, 5.4.9-1.Final_redhat_00001.1.el9eap
IBM Sterling External Authentication Server - addressed in versions 6.0.3.0 iFix 08, 6.1.0.0 iFix 04
IBM Sterling Secure Proxy - update to 6.0.3 iFix 08
IBM Sterling Connect:Direct Web Services - addressed in versions 6.1.0.19, 6.2.0.17
rubygem-puma (Red Hat package) - update to 6.3.1-1.el8sat
rubygem-sidekiq (Red Hat package) - update to 6.5.12-1.el8sat
satellite (Red Hat package) - update to 6.14.2-1.el8sat
StreamSets Data Collector - update to 7.0.0
rubygem-kafo (Red Hat package) - update to 7.2.0-1.el8sat
eap7-wildfly (Red Hat package) - addressed in versions 7.4.14-5.GA_redhat_00002.1.el7eap, 7.4.14-5.GA_redhat_00002.1.el8eap, 7.4.14-5.GA_redhat_00002.1.el9eap
IBM Maximo Asset Management - update to 7.6.1.3.11
puppetserver (Red Hat package) - update to 7.14.0-1.el8sat
puppet-agent (Red Hat package) - update to 7.27.0-1.el8sat
Maximo Manage Application in IBM Maximo Application Suite - update to 8.6.4
IBM Maximo Application Suite - update to 8.6.4
Operational Decision Manager - addressed in versions 8.10.5.1 Interim fix 36, 8.11.0.1 Interim fix 17, 8.11.0.1 Interim fix 18, 8.11.1 Interim fix 7
IBM MQ - addressed in versions 9.0.0.19, 9.1.0.17, 9.2.0.15, 9.3.3
IBM Engineering Systems Design Rhapsody - addressed in versions 9.0.1.0.6, 9.0.2.0.2
jetty9 (Debian package) - addressed in versions 9.4.39-3+deb11u2, 9.4.50-4+deb12u1
jetty-minimal-javadoc - update to 9.4.51-150200.3.19.2
jetty-openid - update to 9.4.51-150200.3.19.2
jetty-annotations - update to 9.4.51-150200.3.19.2
jetty-servlets - update to 9.4.51-150200.3.19.2
jetty-jaas - update to 9.4.51-150200.3.19.2
jetty-jmx - update to 9.4.51-150200.3.19.2
jetty-rewrite - update to 9.4.51-150200.3.19.2
jetty-fcgi - update to 9.4.51-150200.3.19.2
jetty-servlet - update to 9.4.51-150200.3.19.2
jetty-ant - update to 9.4.51-150200.3.19.2
jetty-cdi - update to 9.4.51-150200.3.19.2
jetty-util-ajax - update to 9.4.51-150200.3.19.2
jetty-io - update to 9.4.51-150200.3.19.2
jetty-server - update to 9.4.51-150200.3.19.2
jetty-deploy - update to 9.4.51-150200.3.19.2
jetty-util - update to 9.4.51-150200.3.19.2
jetty-xml - update to 9.4.51-150200.3.19.2
jetty-continuation - update to 9.4.51-150200.3.19.2
jetty-http-spi - update to 9.4.51-150200.3.19.2
jetty-quickstart - update to 9.4.51-150200.3.19.2
jetty-http - update to 9.4.51-150200.3.19.2
jetty-security - update to 9.4.51-150200.3.19.2
jetty-client - update to 9.4.51-150200.3.19.2
jetty-start - update to 9.4.51-150200.3.19.2
jetty-plus - update to 9.4.51-150200.3.19.2
jetty-jsp - update to 9.4.51-150200.3.19.2
jetty-webapp - update to 9.4.51-150200.3.19.2
jetty-jndi - update to 9.4.51-150200.3.19.2
jetty-proxy - update to 9.4.51-150200.3.19.2
Rational Functional Tester (RFT) - update to 10.5.3
Rational Service Tester - update to 10.5.4
webMethods BPM - addressed in versions 10.15 Fix 15, 11.1 Fix 3
eap7-infinispan (Red Hat package) - addressed in versions 11.0.18-1.Final_redhat_00001.1.el7eap, 11.0.18-1.Final_redhat_00001.1.el8eap, 11.0.18-1.Final_redhat_00001.1.el9eap
IBM Cognos Analytics - addressed in versions 11.2.4 FP4, 12.0.4
IBM InfoSphere Information Server - update to 11.7.1.125
rh-sso7-keycloak (Red Hat package) - addressed in versions 18.0.12-1.redhat_00001.1.el7sso, 18.0.12-1.redhat_00001.1.el8sso, 18.0.12-1.redhat_00001.1.el9sso
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3.21, 22.0.2.5
rubygem-foreman_bootdisk (Red Hat package) - update to 21.2.1-1.el8sat
eap7-guava-libraries (Red Hat package) - addressed in versions 32.1.1-2.jre_redhat_00001.1.el7eap, 32.1.1-2.jre_redhat_00001.1.el8eap, 32.1.1-2.jre_redhat_00001.1.el9eap

External References

Related Security Bulletins