{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-36479", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2023-06-21T18:50:41.704Z", "datePublished": "2023-09-15T18:37:35.948Z", "dateUpdated": "2024-08-02T16:45:57.116Z"}, "containers": {"cna": {"title": "Jetty vulnerable to errant command quoting in CGI Servlet", "problemTypes": [{"descriptions": [{"cweId": "CWE-149", "lang": "en", "description": "CWE-149: Improper Neutralization of Quoting Syntax", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.5, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/eclipse/jetty.project/security/advisories/GHSA-3gh6-v5v9-6v9j", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/eclipse/jetty.project/security/advisories/GHSA-3gh6-v5v9-6v9j"}, {"name": "https://github.com/eclipse/jetty.project/pull/9516", "tags": ["x_refsource_MISC"], "url": "https://github.com/eclipse/jetty.project/pull/9516"}, {"name": "https://github.com/eclipse/jetty.project/pull/9888", "tags": ["x_refsource_MISC"], "url": "https://github.com/eclipse/jetty.project/pull/9888"}, {"name": "https://github.com/eclipse/jetty.project/pull/9889", "tags": ["x_refsource_MISC"], "url": "https://github.com/eclipse/jetty.project/pull/9889"}, {"url": "https://www.debian.org/security/2023/dsa-5507"}, {"url": "https://lists.debian.org/debian-lts-announce/2023/09/msg00039.html"}], "affected": [{"vendor": "eclipse", "product": "jetty.project", "versions": [{"version": ">= 9.0.0, <= 9.4.51", "status": "affected"}, {"version": ">= 10.0.0, <= 10.0.15", "status": "affected"}, {"version": ">= 11.0.0, <= 11.0.15", "status": "affected"}, {"version": "<= 12.0.0-beta1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2023-09-15T18:37:35.948Z"}, "descriptions": [{"lang": "en", "value": "Eclipse Jetty Canonical Repository is the canonical repository for the Jetty project. Users of the CgiServlet with a very specific command structure may have the wrong command executed. If a user sends a request to a org.eclipse.jetty.servlets.CGI Servlet for a binary with a space in its name, the servlet will escape the command by wrapping it in quotation marks. This wrapped command, plus an optional command prefix, will then be executed through a call to Runtime.exec. If the original binary name provided by the user contains a quotation mark followed by a space, the resulting command line will contain multiple tokens instead of one. This issue was patched in version 9.4.52, 10.0.16, 11.0.16 and 12.0.0-beta2.\n"}], "source": {"advisory": "GHSA-3gh6-v5v9-6v9j", "discovery": "UNKNOWN"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T16:45:57.116Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/eclipse/jetty.project/security/advisories/GHSA-3gh6-v5v9-6v9j", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/eclipse/jetty.project/security/advisories/GHSA-3gh6-v5v9-6v9j"}, {"name": "https://github.com/eclipse/jetty.project/pull/9516", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/eclipse/jetty.project/pull/9516"}, {"name": "https://github.com/eclipse/jetty.project/pull/9888", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/eclipse/jetty.project/pull/9888"}, {"name": "https://github.com/eclipse/jetty.project/pull/9889", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/eclipse/jetty.project/pull/9889"}, {"url": "https://www.debian.org/security/2023/dsa-5507", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2023/09/msg00039.html", "tags": ["x_transferred"]}]}]}}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*", "matchCriteriaId": "64EE3E5D-9A4F-4C6A-B723-101CF69F89F7", "versionEndExcluding": "9.4.52", "versionStartIncluding": "9.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*", "matchCriteriaId": "1D15B5CF-CDFA-4303-8A9F-CF2FAD8E10CC", "versionEndExcluding": "10.0.16", "versionStartIncluding": "10.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*", "matchCriteriaId": "9153C468-135C-49C4-B33B-1828E37AF483", "versionEndExcluding": "11.0.16", "versionStartIncluding": "11.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:eclipse:jetty:12.0.0:alpha1:*:*:*:*:*:*", "matchCriteriaId": "CA07CE23-17D8-4EFB-A6A2-97CCB8FF8461", "vulnerable": true}, {"criteria": "cpe:2.3:a:eclipse:jetty:12.0.0:alpha2:*:*:*:*:*:*", "matchCriteriaId": "9A862281-65C6-47DC-9A13-521B9187C7CD", "vulnerable": true}, {"criteria": "cpe:2.3:a:eclipse:jetty:12.0.0:alpha3:*:*:*:*:*:*", "matchCriteriaId": "4B999249-2A88-4270-8401-07CF57157D23", "vulnerable": true}, {"criteria": "cpe:2.3:a:eclipse:jetty:12.0.0:beta0:*:*:*:*:*:*", "matchCriteriaId": "C591F4A5-8A66-4A08-B969-C4264A98C7CF", "vulnerable": true}, {"criteria": "cpe:2.3:a:eclipse:jetty:12.0.0:beta1:*:*:*:*:*:*", "matchCriteriaId": "9B9C2A15-1AC2-4DFA-849E-63657784FA3D", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*", "matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73", "vulnerable": true}, {"criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*", "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED", "vulnerable": true}, {"criteria": "cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*", "matchCriteriaId": "46D69DCC-AE4D-4EA5-861C-D60951444C6C", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Eclipse Jetty Canonical Repository is the canonical repository for the Jetty project. Users of the CgiServlet with a very specific command structure may have the wrong command executed. If a user sends a request to a org.eclipse.jetty.servlets.CGI Servlet for a binary with a space in its name, the servlet will escape the command by wrapping it in quotation marks. This wrapped command, plus an optional command prefix, will then be executed through a call to Runtime.exec. If the original binary name provided by the user contains a quotation mark followed by a space, the resulting command line will contain multiple tokens instead of one. This issue was patched in version 9.4.52, 10.0.16, 11.0.16 and 12.0.0-beta2.\n"}, {"lang": "es", "value": "Eclipse Jetty Canonical Repository es el repositorio can\u00f3nico para el proyecto Jetty. Los usuarios de CgiServlet con una estructura de comando muy espec\u00edfica pueden ejecutar el comando incorrecto. Si un usuario env\u00eda una solicitud a un servlet org.eclipse.jetty.servlets.CGI para un binario con un espacio en su nombre, el servlet escapar\u00e1 del comando envolvi\u00e9ndolo entre comillas. Este comando empaquetado, m\u00e1s un prefijo de comando opcional, se ejecutar\u00e1 mediante una llamada a Runtime.exec. Si el nombre binario original proporcionado por el usuario contiene una comilla seguida de un espacio, la l\u00ednea de comando resultante contendr\u00e1 varios tokens en lugar de uno. Este problema se solucion\u00f3 en las versiones 9.4.52, 10.0.16, 11.0.16 y 12.0.0-beta2."}], "id": "CVE-2023-36479", "lastModified": "2023-10-16T19:20:18.767", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.5, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2023-09-15T19:15:08.387", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/eclipse/jetty.project/pull/9516"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/eclipse/jetty.project/pull/9888"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/eclipse/jetty.project/pull/9889"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Patch", "Vendor Advisory"], "url": "https://github.com/eclipse/jetty.project/security/advisories/GHSA-3gh6-v5v9-6v9j"}, {"source": "security-advisories@github.com", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2023/09/msg00039.html"}, {"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "https://www.debian.org/security/2023/dsa-5507"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-149"}], "source": "security-advisories@github.com", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2024:3919", "cpe": "cpe:/a:redhat:migration_toolkit_runtimes:1.0::el8", "package": "mtr/mtr-operator-bundle:1.2-23", "product_name": "Migration Toolkit for Runtimes 1 on RHEL 8", "release_date": "2024-06-13T00:00:00Z"}, {"advisory": "RHSA-2024:3919", "cpe": "cpe:/a:redhat:migration_toolkit_runtimes:1.0::el8", "package": "mtr/mtr-rhel8-operator:1.2-15", "product_name": "Migration Toolkit for Runtimes 1 on RHEL 8", "release_date": "2024-06-13T00:00:00Z"}, {"advisory": "RHSA-2024:3919", "cpe": "cpe:/a:redhat:migration_toolkit_runtimes:1.0::el8", "package": "mtr/mtr-web-container-rhel8:1.2-16", "product_name": "Migration Toolkit for Runtimes 1 on RHEL 8", "release_date": "2024-06-13T00:00:00Z"}, {"advisory": "RHSA-2024:3919", "cpe": "cpe:/a:redhat:migration_toolkit_runtimes:1.0::el8", "package": "mtr/mtr-web-executor-container-rhel8:1.2-14", "product_name": "Migration Toolkit for Runtimes 1 on RHEL 8", "release_date": "2024-06-13T00:00:00Z"}, {"advisory": "RHSA-2024:3989", "cpe": "cpe:/a:redhat:migration_toolkit_applications:6.2::el9", "package": "mta/mta-windup-addon-rhel9:6.2.3-2", "product_name": "MTA-6.2-RHEL-9", "release_date": "2024-06-20T00:00:00Z"}, {"advisory": "RHSA-2023:7247", "cpe": "cpe:/a:redhat:jboss_fuse:7", "package": "jetty-servlets", "product_name": "Red Hat Fuse 7.12.1", "release_date": "2023-11-15T00:00:00Z"}, {"advisory": "RHSA-2024:3354", "cpe": "cpe:/a:redhat:jboss_fuse:7", "package": "jetty-servlets", "product_name": "Red Hat Fuse 7.13.0", "release_date": "2024-05-23T00:00:00Z"}, {"advisory": "RHSA-2024:0797", "cpe": "cpe:/a:redhat:satellite:6.14::el8", "package": "candlepin-0:4.3.11-1.el8sat", "product_name": "Red Hat Satellite 6.14 for RHEL 8", "release_date": "2024-02-13T00:00:00Z"}, {"advisory": "RHSA-2024:2010", "cpe": "cpe:/a:redhat:satellite:6.15::el8", "package": "puppetserver-0:7.14.0-1.el8sat", "product_name": "Red Hat Satellite 6.15 for RHEL 8", "release_date": "2024-04-23T00:00:00Z"}, {"advisory": "RHSA-2024:2010", "cpe": "cpe:/a:redhat:satellite_capsule:6.15::el8", "package": "puppetserver-0:7.14.0-1.el8sat", "product_name": "Red Hat Satellite 6.15 for RHEL 8", "release_date": "2024-04-23T00:00:00Z"}], "bugzilla": {"description": "jetty: Improper addition of quotation marks to user inputs in CgiServlet", "id": "2239630", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2239630"}, "csaw": false, "cvss3": {"cvss3_base_score": "3.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N", "status": "verified"}, "cwe": "CWE-149", "details": ["Eclipse Jetty Canonical Repository is the canonical repository for the Jetty project. Users of the CgiServlet with a very specific command structure may have the wrong command executed. If a user sends a request to a org.eclipse.jetty.servlets.CGI Servlet for a binary with a space in its name, the servlet will escape the command by wrapping it in quotation marks. This wrapped command, plus an optional command prefix, will then be executed through a call to Runtime.exec. If the original binary name provided by the user contains a quotation mark followed by a space, the resulting command line will contain multiple tokens instead of one. This issue was patched in version 9.4.52, 10.0.16, 11.0.16 and 12.0.0-beta2.", "A flaw was found in Jetty's CGI servlet which permits incorrect command execution in specific circumstances such as requests with certain characters in requested filenames. This issue could allow an attacker to run permitted commands other than the one requested."], "name": "CVE-2023-36479", "package_state": [{"cpe": "cpe:/a:redhat:serverless:1", "fix_state": "Will not fix", "package_name": "org.kie.kogito-kogito-apps", "product_name": "OpenShift Serverless"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "jetty", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Will not fix", "package_name": "jetty", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Will not fix", "package_name": "jetty", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:jboss_amq:6", "fix_state": "Out of support scope", "package_name": "jetty-servlets", "product_name": "Red Hat JBoss A-MQ 6"}, {"cpe": "cpe:/a:redhat:amq_broker:7", "fix_state": "Not affected", "package_name": "jetty-servlets", "product_name": "Red Hat JBoss A-MQ 7"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7", "fix_state": "Not affected", "package_name": "jetty", "product_name": "Red Hat JBoss Enterprise Application Platform 7"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:8", "fix_state": "Not affected", "package_name": "jetty", "product_name": "Red Hat JBoss Enterprise Application Platform 8"}, {"cpe": "cpe:/a:redhat:jbosseapxp", "fix_state": "Not affected", "package_name": "jetty", "product_name": "Red Hat JBoss Enterprise Application Platform Expansion Pack"}, {"cpe": "cpe:/a:redhat:jboss_fuse:6", "fix_state": "Out of support scope", "package_name": "jetty-servlets", "product_name": "Red Hat JBoss Fuse 6"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Will not fix", "package_name": "openshift4/ose-metering-hive", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_bpms_platform:7", "fix_state": "Out of support scope", "package_name": "jetty-servlets", "product_name": "Red Hat Process Automation 7"}, {"cpe": "cpe:/a:redhat:amq_streams:1", "fix_state": "Under investigation", "package_name": "jetty", "product_name": "streams for Apache Kafka"}, {"cpe": "cpe:/a:redhat:amq_streams:1", "fix_state": "Out of support scope", "package_name": "jetty-servlets", "product_name": "streams for Apache Kafka"}], "public_date": "2023-09-19T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2023-36479\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-36479"], "threat_severity": "Low", "upstream_fix": "jetty 12.0.0beta, jetty 9.4.52, jetty 10.0.16, jetty 11.0.16"}