Sep
01
2026
Security problems in embedded jetty
- There was no section "ExcludedProtocols" in the jetty.xml even if the help stated it should be there
- The HTTP server configuration display showed the possible TLS protocols of the security engine but not the filtered list by the jetty.xml section "ExcludedProtocols"
- The file encoding guess mechanism has set UTF-16 detection before ISO-8859-1 detection - this is not useful because UTF-16 does match quiet often. The result was an unusal encoding in some payload displays
- There was problem deleting local stations if they have been used to overwrite the security settings of other remote partners
- Dependencies: Updated jetty to 12.0.38 (integrated HTTP server), this fixes the security problems CVE-2024-7708, CVE-2026-8384, CVE-2026-6790, CVE-2026-10051, CVE-2026-10050, CVE-2026-5795
- Dependencies: Updated jsch to 2.28.7 (SSH engine, used for proxy connections)