In Eclipse Jetty versions 9.4.0 thru 9.4.46, and 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, the parsing of the authority segment of an http scheme URI, the Jetty HttpURI class improperly detects an invalid input as a hostname. This can lead to failures in a Proxy scenario.
CVSS Details
- CVSS 3.1 Base Score: 2.7
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade jetty9 | Aug 23, 2022 | Jul 7, 2022 |
| Suse | — | Upgrade jetty-websocket-commonUpgrade jetty-websocket-javadocUpgrade jetty-javax-websocket-client-implUpgrade jetty-httpUpgrade jetty-websocket-serverUpgrade jetty-rewriteUpgrade jetty-plusUpgrade jetty-openidUpgrade jetty-jaasUpgrade jetty-cdiUpgrade jetty-ioUpgrade jetty-jspUpgrade jetty-fcgiUpgrade jetty-securityUpgrade jetty-antUpgrade jetty-websocket-clientUpgrade jetty-deployUpgrade jetty-clientUpgrade jetty-quickstartUpgrade jetty-annotationsUpgrade jetty-websocket-servletUpgrade jetty-utilUpgrade jetty-servletUpgrade jetty-continuationUpgrade jetty-http-spiUpgrade jetty-serverUpgrade jetty-jndiUpgrade jetty-util-ajaxUpgrade jetty-javax-websocket-server-implUpgrade jetty-websocket-apiUpgrade jetty-startUpgrade jetty-webappUpgrade jetty-proxyUpgrade jetty-minimal-javadocUpgrade jetty-servletsUpgrade jetty-jmxUpgrade jetty-xml | Mar 20, 2023 | Jul 7, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub