GHSA-cj7v-27pg-wf7qLowCVSS 2.7
Jetty invalid URI parsing may produce invalid HttpURI.authority
🔗 CVE IDs covered (1)
📋 Description
Description
URI use within Jetty's HttpURI class can parse invalid URIs such as http://localhost;/path as having an authority with a host of localhost;.
A URIs of the type http://localhost;/path should be interpreted to be either invalid or as localhost; to be the userinfo and no host.
However, HttpURI.host returns localhost; which is definitely wrong.
Impact
This can lead to errors with Jetty's HttpClient, and Jetty's ProxyServlet / AsyncProxyServlet / AsyncMiddleManServlet wrongly interpreting an authority with no host as one with a host.
Patches
Patched in PR #8146 for Jetty version 9.4.47. Patched in PR #8014 for Jetty versions 10.0.10, and 11.0.10
Workarounds
None.
For more information
If you have any questions or comments about this advisory:
- Email us at [email protected].
🎯 Affected products3
- maven/org.eclipse.jetty:jetty-http:< 9.4.47
- maven/org.eclipse.jetty:jetty-http:>= 10.0.0, < 10.0.10
- maven/org.eclipse.jetty:jetty-http:>= 11.0.0, < 11.0.10
🔗 References (6)
- https://github.com/eclipse/jetty.project/security/advisories/GHSA-cj7v-27pg-wf7q
- https://nvd.nist.gov/vuln/detail/CVE-2022-2047
- https://www.debian.org/security/2022/dsa-5198
- https://lists.debian.org/debian-lts-announce/2022/08/msg00011.html
- https://security.netapp.com/advisory/ntap-20220901-0006/
- https://github.com/advisories/GHSA-cj7v-27pg-wf7q