The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
Eclipse Jetty Canonical Repository is the canonical repository for the Jetty project. Users of the CgiServlet with a very specific command structure may have the wrong command executed. If a user sends a request to a org.eclipse.jetty.servlets.CGI Servlet for a binary with a space in its name, the servlet will escape the command by wrapping it in quotation marks. This wrapped command, plus an optional command prefix, will then be executed through a call to Runtime.exec. If the original binary name provided by the user contains a quotation mark followed by a space, the resulting command line will contain multiple tokens instead of one. This issue was patched in version 9.4.52, 10.0.16, 11.0.16 and 12.0.0-beta2.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade jetty-httpUpgrade jetty-websocket-clientUpgrade jetty-jndiUpgrade jetty-continuationUpgrade jetty-runnerUpgrade jetty-ioUpgrade jetty-webappUpgrade jetty-maven-pluginUpgrade jetty-serverUpgrade jetty-websocket-apiUpgrade jetty-proxyUpgrade jetty-plusUpgrade jetty-annotationsUpgrade jetty-jspUpgrade jetty-deployUpgrade jetty-websocket-serverUpgrade jetty-utilUpgrade jetty-monitorUpgrade jetty-util-ajaxUpgrade jetty-clientUpgrade jetty-jspc-maven-pluginUpgrade jetty-xmlUpgrade jetty-websocket-commonUpgrade jetty-jaspiUpgrade jetty-projectUpgrade jetty-javadocUpgrade jetty-securityUpgrade jetty-websocket-servletUpgrade jetty-antUpgrade jetty-jaasUpgrade jetty-jmxUpgrade jetty-servletsUpgrade jetty-websocket-parentUpgrade jetty-startUpgrade jetty-servletUpgrade jetty-rewrite | Jan 10, 2024 | Sep 15, 2023 |
| Debian | — | Upgrade jetty9 | Oct 2, 2023 | Sep 15, 2023 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Sep 15, 2023 |
| Suse | — | Upgrade jetty-jmxUpgrade jetty-clientUpgrade jetty-ioUpgrade jetty-annotationsUpgrade jetty-plusUpgrade jetty-continuationUpgrade jetty-openidUpgrade jetty-serverUpgrade jetty-servletUpgrade jetty-deployUpgrade jetty-proxyUpgrade jetty-quickstartUpgrade jetty-webappUpgrade jetty-util-ajaxUpgrade jetty-jndiUpgrade jetty-http-spiUpgrade jetty-utilUpgrade jetty-antUpgrade jetty-jspUpgrade jetty-minimal-javadocUpgrade jetty-jaasUpgrade jetty-servletsUpgrade jetty-securityUpgrade jetty-cdiUpgrade jetty-httpUpgrade jetty-startUpgrade jetty-rewriteUpgrade jetty-fcgiUpgrade jetty-xml | Oct 27, 2023 | Sep 15, 2023 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub