The Apache Project has released Geronimo 1.0, and a security hoile has already been found in its bundled Jetty Web Container. What's an Apache Project doing using Jetty instead of Tomcat anyway?. Don't install this, at least not on Windows. Wait for 1.0.1.