Jetty invalid URI parsing may produce invalid HttpURI.authority

🗓️ 07 Jul 2022 20:55:34Reported by GitHub Advisory DatabaseType

github

github🔗 github.com👁 37 Views

Jetty HTTP URI parsing vulnerabilit

Reporter	Title	Published	Views	Family All 98
IBM Security Bulletins	Security Bulletin: IBM Secure External Authentication Server is vulnerable to multiple issues due to Eclipse Jetty	29 Jul 202217:36	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Zookeeper affecting IBM QRadar User Behavior Analytics (CVE-2022-2191, CVE-2022-2047, CVE-2022-2048, CVE-2022-24823, CVE-2020-36518)	29 Sep 202214:01	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in Eclipse Jetty affects IBM Process Mining . CVE-2022-2047	1 Feb 202321:59	–	ibm
IBM Security Bulletins	Security Bulletin: There is a vulnerability in Eclipse Jetty used by IBM Maximo Asset Management (CVE-2022-2047)	2 Mar 202314:09	–	ibm
IBM Security Bulletins	Security Bulletin: Security fixes available for The IBM® Engineering System Design Rhapsody products on IBM Jazz Technology	7 Jun 202406:01	–	ibm
IBM Security Bulletins	Security Bulletin: Due to the use of jetty IBM webMethods BPM is vulnerable to multiple vulnerabilities	27 Mar 202608:06	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cognos Command Center is affected by multiple vulnerabilities	4 May 202320:23	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar SIEM is vulnerable to Using Components with Known Vulnerabilities	26 Oct 202218:06	–	ibm
IBM Security Bulletins	Security Bulletin: Rational Service Tester contains vulnerabilities which could affect Eclipse Jetty. Rational Service Tester has taken steps to mitigate these vulnerabilities.	22 Nov 202213:50	–	ibm
IBM Security Bulletins	Security Bulletin: Due to the use of jetty IBM webMethods BPM is vulnerable to multiple vulnerabilities	11 Mar 202620:59	–	ibm

Vulners

Node

org.eclipse.jetty jetty-httpRange11.0.0–11.0.10maven

OR

org.eclipse.jetty jetty-httpRange10.0.0–10.0.10maven

OR

org.eclipse.jetty jetty-httpRange<9.4.47maven

Source	Link
github	www.github.com/eclipse/jetty.project/security/advisories/GHSA-cj7v-27pg-wf7q
nvd	www.nvd.nist.gov/vuln/detail/CVE-2022-2047
debian	www.debian.org/security/2022/dsa-5198
lists	www.lists.debian.org/debian-lts-announce/2022/08/msg00011.html
security	www.security.netapp.com/advisory/ntap-20220901-0006/
github	www.github.com/advisories/GHSA-cj7v-27pg-wf7q

29 Jan 2023 05:06Current

5.5Medium risk

Vulners AI Score5.5

CVSS 3.12.7

CVSS 24

EPSS0.00401

jetty http uri parsing vulnerability authority httpclient proxyservlet asyncproxyservlet asyncmiddlemanservlet error patch version 9.4.47 version 10.0.10 version 11.0.10 webtide security advisory