On 03/21/2011 12:41 PM, Gottfrid Linge wrote:
>
> Is there a plan to upgrade to latest Jetty and does anyone know if the known
> security issues for Jetty are that bad?
As far as I can understand, all but one of these exploits are related to
servlets
that should not be exposed in a production environment (dump servlets, demo
ones,
etc), a simple HTTPd with mod_proxy will do to effectively hide them, though
not
deploying said servlets at all would be better.
However, there is a possible pitfall for GeoServer (or any other webapp) as
well
in exploit F:
<<F) HTTP Content-Length header escape sequence injection
(Affected versions: Any)
The same attack vector presented in point "E" can be exploited by
requesting a page using an HTTP request "Content-Length" header set to
a letteral string. This raises a type mismatch exception as previously
shown. See the following PoC:
$ curl 127.0.0.1:8080 -H "Content-Length: abcde"
The difference between this possibility and the one exposed in "E" is
that this works not only on Jetty default demo applications but on every
application that Jetty will serve.>>
Regards,
Luca Morandini
http://www.lucamorandini.it
------------------------------------------------------------------------------
Colocation vs. Managed Hosting
A question and answer guide to determining the best fit
for your organization - today and in the future.
http://p.sf.net/sfu/internap-sfd2d
_______________________________________________
Geoserver-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/geoserver-users
