Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package jetty-minimal for openSUSE:Factory checked in at 2026-08-13 13:16:08 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/jetty-minimal (Old) and /work/SRC/openSUSE:Factory/.jetty-minimal.new.17972 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "jetty-minimal" Thu Aug 13 13:16:08 2026 rev:33 rq:1370872 version:9.4.58 Changes: -------- +++ only whitespace diff in changes, re-diffing jetty-http2.changes: same change --- /work/SRC/openSUSE:Factory/jetty-minimal/jetty-minimal.changes 2026-04-18 23:20:33.592820276 +0200 +++ /work/SRC/openSUSE:Factory/.jetty-minimal.new.17972/jetty-minimal.changes 2026-08-13 13:17:05.188723842 +0200 @@ -1,0 +2,14 @@ +Wed Aug 12 12:53:58 UTC 2026 - Fridrich Strba <[email protected]> + +- Added patch: + * jetty-CVE-2026-10050.patch + + backport of upstream patch fixing bsc#1272393 + (CVE-2026-10050): Digest Authentication: ISO-8859-1 lossy + encoding allows authentication bypass via character + substitution +- Modified patch: + * jetty-CVE-2026-2332.patch + + Add one additional test and missing hunk from the backport of + ff9eb742492d6dc3191bcd49668b1bce1e620d57 + +------------------------------------------------------------------- +++ only whitespace diff in changes, re-diffing jetty-websocket.changes: same change New: ---- jetty-CVE-2026-10050.patch ----------(New B)---------- New:/work/SRC/openSUSE:Factory/.jetty-minimal.new.17972/jetty-minimal.changes-- Added patch: /work/SRC/openSUSE:Factory/.jetty-minimal.new.17972/jetty-minimal.changes: * jetty-CVE-2026-10050.patch /work/SRC/openSUSE:Factory/.jetty-minimal.new.17972/jetty-minimal.changes- + backport of upstream patch fixing bsc#1272393 ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ jetty-http2.spec: same change ++++++ jetty-minimal.spec ++++++ --- /var/tmp/diff_new_pack.MmkfJg/_old 2026-08-13 13:17:06.152767606 +0200 +++ /var/tmp/diff_new_pack.MmkfJg/_new 2026-08-13 13:17:06.156767787 +0200 @@ -32,6 +32,7 @@ Patch1: jetty-CVE-2025-11143.patch Patch2: jetty-CVE-2026-2332.patch Patch3: jetty-CVE-2026-5795.patch +Patch4: jetty-CVE-2026-10050.patch BuildRequires: fdupes BuildRequires: java-devel >= 1.8 BuildRequires: maven-local jetty-websocket.spec: same change ++++++ _scmsync.obsinfo ++++++ --- /var/tmp/diff_new_pack.MmkfJg/_old 2026-08-13 13:17:06.268772872 +0200 +++ /var/tmp/diff_new_pack.MmkfJg/_new 2026-08-13 13:17:06.272773053 +0200 @@ -1,6 +1,6 @@ -mtime: 1776535977 -commit: 1251b91605b3f263f620761ae8548b8111cc923a566002a01ba0241e6b37b8b8 -url: https://src.opensuse.org/java-packages/jetty-minimal.git -revision: 1251b91605b3f263f620761ae8548b8111cc923a566002a01ba0241e6b37b8b8 +mtime: 1786540068 +commit: 1288a8f44d7f9c9ee8ab4c696eaca9ffac8a916daca520fd2ca5777dc092a02f +url: https://src.opensuse.org/java-packages/jetty-minimal +revision: 1288a8f44d7f9c9ee8ab4c696eaca9ffac8a916daca520fd2ca5777dc092a02f projectscmsync: https://src.opensuse.org/java-packages/_ObsPrj ++++++ build.specials.obscpio ++++++ ++++++ build.specials.obscpio ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/.gitignore new/.gitignore --- old/.gitignore 1970-01-01 01:00:00.000000000 +0100 +++ new/.gitignore 2026-08-12 15:07:48.000000000 +0200 @@ -0,0 +1 @@ +.osc ++++++ jetty-CVE-2026-10050.patch ++++++ ++++ 1327 lines (skipped) ++++++ jetty-CVE-2026-2332.patch ++++++ --- /var/tmp/diff_new_pack.MmkfJg/_old 2026-08-13 13:17:06.504783585 +0200 +++ /var/tmp/diff_new_pack.MmkfJg/_new 2026-08-13 13:17:06.512783949 +0200 @@ -1,3 +1,26 @@ +From 8e2c1c864dcf61c5f45c875580d57bbc2a56ce7a Mon Sep 17 00:00:00 2001 +From: Fridrich Strba <[email protected]> +Date: Wed, 15 Jul 2026 07:48:16 +0200 +Subject: [PATCH 1/2] CVE-2026-2332 + +--- + .../org/eclipse/jetty/http/HttpMethod.java | 34 + + .../org/eclipse/jetty/http/HttpParser.java | 843 +++++++++++++----- + .../org/eclipse/jetty/http/HttpTokens.java | 3 + + .../eclipse/jetty/http/HttpParserTest.java | 18 +- + .../org/eclipse/jetty/server/Request.java | 13 +- + .../jetty/server/ChunkSizeExtensionTest.java | 308 +++++++ + .../jetty/server/HttpConnectionTest.java | 131 +-- + .../jetty/server/HttpServerTestBase.java | 2 +- + .../jetty/server/PartialRFC2616Test.java | 40 +- + .../server/handler/SizeLimitHandlerTest.java | 2 +- + .../jetty/servlet/MultiPartServletTest.java | 37 + + .../jetty/test/rfcs/RFC2616BaseTest.java | 40 +- + 12 files changed, 1123 insertions(+), 348 deletions(-) + create mode 100644 jetty-server/src/test/java/org/eclipse/jetty/server/ChunkSizeExtensionTest.java + +diff --git a/jetty-http/src/main/java/org/eclipse/jetty/http/HttpMethod.java b/jetty-http/src/main/java/org/eclipse/jetty/http/HttpMethod.java +index cc5534c59da..d1be6bc3121 100644 --- a/jetty-http/src/main/java/org/eclipse/jetty/http/HttpMethod.java +++ b/jetty-http/src/main/java/org/eclipse/jetty/http/HttpMethod.java @@ -166,6 +166,40 @@ public enum HttpMethod @@ -41,6 +64,8 @@ /** * Optimized lookup to find a method name and trailing space in a byte array. * +diff --git a/jetty-http/src/main/java/org/eclipse/jetty/http/HttpParser.java b/jetty-http/src/main/java/org/eclipse/jetty/http/HttpParser.java +index 4db6716487e..382ef59ed0e 100644 --- a/jetty-http/src/main/java/org/eclipse/jetty/http/HttpParser.java +++ b/jetty-http/src/main/java/org/eclipse/jetty/http/HttpParser.java @@ -105,14 +105,24 @@ public class HttpParser @@ -1269,6 +1294,8 @@ public static final Token[] TOKENS = new Token[256]; static +diff --git a/jetty-http/src/test/java/org/eclipse/jetty/http/HttpParserTest.java b/jetty-http/src/test/java/org/eclipse/jetty/http/HttpParserTest.java +index ff19c595f98..3de73bdce01 100644 --- a/jetty-http/src/test/java/org/eclipse/jetty/http/HttpParserTest.java +++ b/jetty-http/src/test/java/org/eclipse/jetty/http/HttpParserTest.java @@ -1030,7 +1030,7 @@ public class HttpParserTest @@ -1352,6 +1379,33 @@ "0123456789\r\n" + "1a\r\n" + "ABCDEFGHIJKLMNOPQRSTUVWXYZ\r\n" + +diff --git a/jetty-server/src/main/java/org/eclipse/jetty/server/Request.java b/jetty-server/src/main/java/org/eclipse/jetty/server/Request.java +index 2f60fb7d308..7892caf9dda 100644 +--- a/jetty-server/src/main/java/org/eclipse/jetty/server/Request.java ++++ b/jetty-server/src/main/java/org/eclipse/jetty/server/Request.java +@@ -1952,7 +1952,18 @@ public class Request implements HttpServletRequest + _session = null; + _sessionHandler = null; + _timeStamp = 0; +- _multiParts = null; ++ if (_multiParts != null) ++ { ++ try ++ { ++ _multiParts.close(); ++ } ++ catch (IOException e) ++ { ++ LOG.warn("Error closing multiparts", e); ++ } ++ _multiParts = null; ++ } + if (_async != null) + _async.reset(); + _async = null; +diff --git a/jetty-server/src/test/java/org/eclipse/jetty/server/ChunkSizeExtensionTest.java b/jetty-server/src/test/java/org/eclipse/jetty/server/ChunkSizeExtensionTest.java +new file mode 100644 +index 00000000000..f21763a33c6 --- /dev/null +++ b/jetty-server/src/test/java/org/eclipse/jetty/server/ChunkSizeExtensionTest.java @@ -0,0 +1,308 @@ @@ -1663,6 +1717,8 @@ + assertThat(response.getStatus(), equalTo(HttpStatus.OK_200)); + } +} +diff --git a/jetty-server/src/test/java/org/eclipse/jetty/server/HttpConnectionTest.java b/jetty-server/src/test/java/org/eclipse/jetty/server/HttpConnectionTest.java +index f2a7bcdf9bc..6c52c04c2c0 100644 --- a/jetty-server/src/test/java/org/eclipse/jetty/server/HttpConnectionTest.java +++ b/jetty-server/src/test/java/org/eclipse/jetty/server/HttpConnectionTest.java @@ -65,6 +65,7 @@ import org.junit.jupiter.api.Test; @@ -1979,6 +2035,8 @@ os.flush(); // Read the response. +diff --git a/jetty-server/src/test/java/org/eclipse/jetty/server/PartialRFC2616Test.java b/jetty-server/src/test/java/org/eclipse/jetty/server/PartialRFC2616Test.java +index b41b0b81186..8b40c69c694 100644 --- a/jetty-server/src/test/java/org/eclipse/jetty/server/PartialRFC2616Test.java +++ b/jetty-server/src/test/java/org/eclipse/jetty/server/PartialRFC2616Test.java @@ -145,9 +145,9 @@ public class PartialRFC2616Test @@ -2081,6 +2139,8 @@ "\n" + "GET /R2 HTTP/1.1\n" + +diff --git a/jetty-server/src/test/java/org/eclipse/jetty/server/handler/SizeLimitHandlerTest.java b/jetty-server/src/test/java/org/eclipse/jetty/server/handler/SizeLimitHandlerTest.java +index b3fa0da26a4..8faf70e037c 100644 --- a/jetty-server/src/test/java/org/eclipse/jetty/server/handler/SizeLimitHandlerTest.java +++ b/jetty-server/src/test/java/org/eclipse/jetty/server/handler/SizeLimitHandlerTest.java @@ -252,7 +252,7 @@ public class SizeLimitHandlerTest @@ -2092,6 +2152,54 @@ HttpTester.Response response = HttpTester.parseResponse(endp.getResponse()); +diff --git a/jetty-servlet/src/test/java/org/eclipse/jetty/servlet/MultiPartServletTest.java b/jetty-servlet/src/test/java/org/eclipse/jetty/servlet/MultiPartServletTest.java +index a26437a886e..1481c8030d4 100644 +--- a/jetty-servlet/src/test/java/org/eclipse/jetty/servlet/MultiPartServletTest.java ++++ b/jetty-servlet/src/test/java/org/eclipse/jetty/servlet/MultiPartServletTest.java +@@ -416,4 +416,41 @@ public class MultiPartServletTest + assertThat(IO.toString(parts.get(0).getInputStream()), is(contentString)); + } + } ++ ++ @ParameterizedTest ++ @MethodSource("complianceModes") ++ public void testTemporaryPart(MultiPartFormDataCompliance compliance) throws Exception ++ { ++ connector.getConnectionFactory(HttpConnectionFactory.class).getHttpConfiguration() ++ .setMultiPartFormDataCompliance(compliance); ++ ++ byte[] byteArray = new byte[10 * 1024]; ++ Arrays.fill(byteArray, (byte)1); ++ BytesContentProvider contentProvider = new BytesContentProvider(byteArray); ++ ++ MultiPartContentProvider multiPart = new MultiPartContentProvider(); ++ multiPart.addFieldPart("largePart", contentProvider, null); ++ multiPart.close(); ++ ++ ContentResponse response = client.newRequest("localhost", connector.getLocalPort()) ++ .scheme(HttpScheme.HTTP.asString()) ++ .method(HttpMethod.POST) ++ .content(multiPart) ++ .send(); ++ ++ assertEquals(200, response.getStatus()); ++ ++ boolean deleted = false; ++ for (int i = 0; i < 50; i++) ++ { ++ String[] fileList = tmpDir.toFile().list(); ++ if (fileList != null && fileList.length == 0) ++ { ++ deleted = true; ++ break; ++ } ++ Thread.sleep(100); ++ } ++ org.junit.jupiter.api.Assertions.assertTrue(deleted); ++ } + } +diff --git a/tests/test-integration/src/test/java/org/eclipse/jetty/test/rfcs/RFC2616BaseTest.java b/tests/test-integration/src/test/java/org/eclipse/jetty/test/rfcs/RFC2616BaseTest.java +index 24e268c1fd7..6b2e95fae17 100644 --- a/tests/test-integration/src/test/java/org/eclipse/jetty/test/rfcs/RFC2616BaseTest.java +++ b/tests/test-integration/src/test/java/org/eclipse/jetty/test/rfcs/RFC2616BaseTest.java @@ -172,9 +172,9 @@ public abstract class RFC2616BaseTest @@ -2194,4 +2302,7 @@ req2.append("\n"); req2.append("GET /echo/R2 HTTP/1.1\n"); +-- +2.55.0 +
