In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes. This was done because the initial specification for HTTP did not specify explicit…
Summary
In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes. This was done because the initial specification for HTTP did not specify explicitly a charset, and it was assumed to be ISO-8859-1 for historical reasons. If the password contains characters that cannot be represented in ISO-8859-1, they are silently replaced by `?`. This happens with passwords that contain Chinese, Cyrillic or Greek characters, for example: `αβ123` converts …
In-depth triage · Auto channel
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Affected products
- :
Lint boundary warnings (1)
The following non-blocking warnings were raised during the lint phase of this triage (e.g. reference URLs not yet on the allowlist). They do not affect entry usability and are disclosed for transparency (see DR-002).
-
REF_URL_NOT_ALLOWLISTEDurl not in allowlist: https://gitlab.eclipse.org/security/cve-assignment/-/work_items/120
Sources
- NVD DATABASE
Original Links
- https://github.com/jetty/jetty.project/security/advisories/GHSA-2fvj-hgj9-j2gr Vendor Advisory
- https://gitlab.eclipse.org/security/cve-assignment/-/work_items/120 Issue Tracking
- https://github.com/jetty/jetty.project/security/advisories/GHSA-2fvj-hgj9-j2gr Vendor Advisory
Timeline
- nvd_ingest NVD