Description
Eclipse Jetty Canonical Repository is the canonical repository for the Jetty project. Users of the CgiServlet with a very specific command structure may have the wrong command executed. If a user sends a request to a org.eclipse.jetty.servlets.CGI Servlet for a binary with a space in its name, the servlet will escape the command by wrapping it in quotation marks. This wrapped command, plus an optional command prefix, will then be executed through a call to Runtime.exec. If the original binary name provided by the user contains a quotation mark followed by a space, the resulting command line will contain multiple tokens instead of one. This issue was patched in version 9.4.52, 10.0.16, 11.0.16 and 12.0.0-beta2.
Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| eclipse | jetty.project | affected |
|
Configuration 1 [-]
|
Configuration 2 [-]
|
| Package | CPE | Advisory | Released Date |
|---|---|---|---|
| Migration Toolkit for Runtimes 1 on RHEL 8 | |||
| mtr/mtr-operator-bundle:1.2-23 | cpe:/a:redhat:migration_toolkit_runtimes:1.0::el8 | RHSA-2024:3919 | 2024-06-13T00:00:00Z |
| mtr/mtr-rhel8-operator:1.2-15 | cpe:/a:redhat:migration_toolkit_runtimes:1.0::el8 | RHSA-2024:3919 | 2024-06-13T00:00:00Z |
| mtr/mtr-web-container-rhel8:1.2-16 | cpe:/a:redhat:migration_toolkit_runtimes:1.0::el8 | RHSA-2024:3919 | 2024-06-13T00:00:00Z |
| mtr/mtr-web-executor-container-rhel8:1.2-14 | cpe:/a:redhat:migration_toolkit_runtimes:1.0::el8 | RHSA-2024:3919 | 2024-06-13T00:00:00Z |
| MTA-6.2-RHEL-9 | |||
| mta/mta-windup-addon-rhel9:6.2.3-2 | cpe:/a:redhat:migration_toolkit_applications:6.2::el9 | RHSA-2024:3989 | 2024-06-20T00:00:00Z |
| Red Hat Fuse 7.12.1 | |||
| jetty-servlets | cpe:/a:redhat:jboss_fuse:7 | RHSA-2023:7247 | 2023-11-15T00:00:00Z |
| Red Hat Fuse 7.13.0 | |||
| jetty-servlets | cpe:/a:redhat:jboss_fuse:7 | RHSA-2024:3354 | 2024-05-23T00:00:00Z |
| Red Hat Satellite 6.14 for RHEL 8 | |||
| candlepin-0:4.3.11-1.el8sat | cpe:/a:redhat:satellite:6.14::el8 | RHSA-2024:0797 | 2024-02-13T00:00:00Z |
| Red Hat Satellite 6.15 for RHEL 8 | |||
| puppetserver-0:7.14.0-1.el8sat | cpe:/a:redhat:satellite:6.15::el8 | RHSA-2024:2010 | 2024-04-23T00:00:00Z |
| puppetserver-0:7.14.0-1.el8sat | cpe:/a:redhat:satellite_capsule:6.15::el8 | RHSA-2024:2010 | 2024-04-23T00:00:00Z |
No data available yet.
Remediation
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
Advisories
| Source | ID | Title |
|---|---|---|
 Debian DLA |
DLA-3592-1 | jetty9 security update |
 Debian DSA |
DSA-5507-1 | jetty9 security update |
 EUVD |
EUVD-2023-2405 | Eclipse Jetty Canonical Repository is the canonical repository for the Jetty project. Users of the CgiServlet with a very specific command structure may have the wrong command executed. If a user sends a request to a org.eclipse.jetty.servlets.CGI Servlet for a binary with a space in its name, the servlet will escape the command by wrapping it in quotation marks. This wrapped command, plus an optional command prefix, will then be executed through a call to Runtime.exec. If the original binary name provided by the user contains a quotation mark followed by a space, the resulting command line will contain multiple tokens instead of one. This issue was patched in version 9.4.52, 10.0.16, 11.0.16 and 12.0.0-beta2. |
 Github GHSA |
GHSA-3gh6-v5v9-6v9j | Jetty vulnerable to errant command quoting in CGI Servlet |
References
History
Tue, 27 May 2025 21:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | NVD-CWE-Other |
Thu, 13 Feb 2025 17:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Eclipse Jetty Canonical Repository is the canonical repository for the Jetty project. Users of the CgiServlet with a very specific command structure may have the wrong command executed. If a user sends a request to a org.eclipse.jetty.servlets.CGI Servlet for a binary with a space in its name, the servlet will escape the command by wrapping it in quotation marks. This wrapped command, plus an optional command prefix, will then be executed through a call to Runtime.exec. If the original binary name provided by the user contains a quotation mark followed by a space, the resulting command line will contain multiple tokens instead of one. This issue was patched in version 9.4.52, 10.0.16, 11.0.16 and 12.0.0-beta2. | Eclipse Jetty Canonical Repository is the canonical repository for the Jetty project. Users of the CgiServlet with a very specific command structure may have the wrong command executed. If a user sends a request to a org.eclipse.jetty.servlets.CGI Servlet for a binary with a space in its name, the servlet will escape the command by wrapping it in quotation marks. This wrapped command, plus an optional command prefix, will then be executed through a call to Runtime.exec. If the original binary name provided by the user contains a quotation mark followed by a space, the resulting command line will contain multiple tokens instead of one. This issue was patched in version 9.4.52, 10.0.16, 11.0.16 and 12.0.0-beta2. |
Wed, 25 Sep 2024 15:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2025-06-18T14:41:11.113Z
Reserved: 2023-06-21T18:50:41.704Z
Link: CVE-2023-36479
Vulnrichment
Updated: 2024-08-02T16:45:57.116Z
NVD
Status : Analyzed
Published: 2023-09-15T19:15:08.387
Modified: 2025-05-27T21:20:37.697
Link: CVE-2023-36479
Redhat
OpenCVE Enrichment
No data.
Weaknesses