Re: [jetty-dev] Question about vulnerability: Assign Proxy header values

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] [List Home]

Re: [jetty-dev] Question about vulnerability: Assign Proxy header values to HTTP_PROXY environment variable

From: Simone Bordet <sbordet@xxxxxxxxxxx>
Date: Thu, 21 Jul 2016 12:20:15 +0200
Delivered-to: jetty-dev@xxxxxxxxxxx
List-archive: <https://dev.eclipse.org/mailman/private/jetty-dev>
List-help: <mailto:jetty-dev-request@eclipse.org?subject=help>
List-subscribe: <https://dev.eclipse.org/mailman/listinfo/jetty-dev>, <mailto:jetty-dev-request@eclipse.org?subject=subscribe>
List-unsubscribe: <https://dev.eclipse.org/mailman/options/jetty-dev>, <mailto:jetty-dev-request@eclipse.org?subject=unsubscribe>

Hi,

On Thu, Jul 21, 2016 at 9:18 AM, Houtman, Roland
<Roland.Houtman@xxxxxxxxxxxxxxx> wrote:
> Dear Devs,
>
>
>
> I’ve been asked to reply if jetty is vulnerable to the next exploit:
>
> http://www.kb.cert.org/vuls/id/797896
>
>
>
> (Our own code doesn’t use this header value.)

We are analyzing this, we will report back.

-- 
Simone Bordet
----
http://cometd.org
http://webtide.com
Developer advice, training, services and support
from the Jetty & CometD experts.

References:
- [jetty-dev] Question about vulnerability: Assign Proxy header values to HTTP_PROXY environment variable
  - From: Houtman, Roland

Prev by Date: [jetty-dev] Question about vulnerability: Assign Proxy header values to HTTP_PROXY environment variable
Next by Date: [jetty-dev] Early Access builds of JDK 8u112 b03, JDK 9 b128 are available on java.net
Previous by thread: [jetty-dev] Question about vulnerability: Assign Proxy header values to HTTP_PROXY environment variable
Next by thread: [jetty-dev] Early Access builds of JDK 8u112 b03, JDK 9 b128 are available on java.net
Index(es):
- Date
- Thread

Breadcrumbs