CVE-2022-2047
published 2022-07-07CVE-2022-2047: In Eclipse Jetty versions 9.4.0 thru 9.4.46, and 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, the parsing of the authority segment of an http scheme…
PriorityP411low2.7CVSS 3.1
AVNACLPRHUINSUCNILAN
EPSS
1.17%
64.2th percentile
In Eclipse Jetty versions 9.4.0 thru 9.4.46, and 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, the parsing of the authority segment of an http scheme URI, the Jetty HttpURI class improperly detects an invalid input as a hostname. This can lead to failures in a Proxy scenario.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | jetty9 | < jetty9 9.4.48-1 (bookworm) | jetty9 9.4.48-1 (bookworm) |
| eclipse | jetty | < 9.4.46 | 9.4.46 |
| eclipse | jetty | >= 10.0.0 < 10.0.9 | 10.0.9 |
| eclipse | jetty | 11.0.0 – 11.0.9 | — |
| the_eclipse_foundation | eclipse_jetty | >= 10.0.0 < unspecified | unspecified |
| the_eclipse_foundation | eclipse_jetty | >= 11.0.0 < unspecified | unspecified |
| the_eclipse_foundation | eclipse_jetty | >= 9.4.0 < unspecified | unspecified |
| the_eclipse_foundation | eclipse_jetty | unspecified – 9.4.46 | — |
CVSS provenance
nvdv3.12.7LOWCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:N/I:P/A:N
osv2.7LOW
vendor_debian2.7LOW
vendor_redhat2.7LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Jetty invalid URI parsing may produce invalid HttpURI.authority
ghsa·2022-07-07
CVE-2022-2047 [LOW] CWE-20 Jetty invalid URI parsing may produce invalid HttpURI.authority
Jetty invalid URI parsing may produce invalid HttpURI.authority
### Description
URI use within Jetty's `HttpURI` class can parse invalid URIs such as `http://localhost;/path` as having an authority with a host of `localhost;`.
A URIs of the type `http://localhost;/path` should be interpreted to be either invalid or as `localhost;` to be the userinfo and no host.
However, `HttpURI.host` returns `localhost;` which is definitely wrong.
### Impact
This can lead to errors with Jetty's `HttpClient`, and Jetty's `ProxyServlet` / `AsyncProxyServlet` / `AsyncMiddleManServlet` wrongly interpreting an authority with no host as one with a host.
### Patches
Patched in PR [#8146](https://github.com/eclipse/jetty.project/pull/8146) for Jetty version 9.4.47.
Patched in PR [#8014](https://github.com/ec
OSV
Jetty invalid URI parsing may produce invalid HttpURI.authority
osv·2022-07-07
CVE-2022-2047 [LOW] Jetty invalid URI parsing may produce invalid HttpURI.authority
Jetty invalid URI parsing may produce invalid HttpURI.authority
### Description
URI use within Jetty's `HttpURI` class can parse invalid URIs such as `http://localhost;/path` as having an authority with a host of `localhost;`.
A URIs of the type `http://localhost;/path` should be interpreted to be either invalid or as `localhost;` to be the userinfo and no host.
However, `HttpURI.host` returns `localhost;` which is definitely wrong.
### Impact
This can lead to errors with Jetty's `HttpClient`, and Jetty's `ProxyServlet` / `AsyncProxyServlet` / `AsyncMiddleManServlet` wrongly interpreting an authority with no host as one with a host.
### Patches
Patched in PR [#8146](https://github.com/eclipse/jetty.project/pull/8146) for Jetty version 9.4.47.
Patched in PR [#8014](https://github.com/ec
OSV
CVE-2022-2047: In Eclipse Jetty versions 9
osv·2022-07-07·CVSS 2.7
CVE-2022-2047 [LOW] CVE-2022-2047: In Eclipse Jetty versions 9
In Eclipse Jetty versions 9.4.0 thru 9.4.46, and 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, the parsing of the authority segment of an http scheme URI, the Jetty HttpURI class improperly detects an invalid input as a hostname. This can lead to failures in a Proxy scenario.
Red Hat
jetty-http: improver hostname input handling
vendor_redhat·2022-07-07·CVSS 2.7
CVE-2022-2047 [LOW] CWE-20 jetty-http: improver hostname input handling
jetty-http: improver hostname input handling
In Eclipse Jetty versions 9.4.0 thru 9.4.46, and 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, the parsing of the authority segment of an http scheme URI, the Jetty HttpURI class improperly detects an invalid input as a hostname. This can lead to failures in a Proxy scenario.
A flaw was found in Eclipse Jetty. When parsing the authority segment of an HTTP scheme URI, the Jetty HttpURI class improperly detects an invalid input as a hostname. This issue can lead to failures in a Proxy scenario.
Statement: In Red Hat Satellite jetty was used to build index files to search documentation. Nowadays in Satellite 6.9 and 6.10 jetty dependency is not in use and there is no access to it, so there is no way this vulnerability can be exploitable.
Debian
CVE-2022-2047: jetty9 - In Eclipse Jetty versions 9.4.0 thru 9.4.46, and 10.0.0 thru 10.0.9, and 11.0.0 ...
vendor_debian·2022·CVSS 2.7
CVE-2022-2047 [LOW] CVE-2022-2047: jetty9 - In Eclipse Jetty versions 9.4.0 thru 9.4.46, and 10.0.0 thru 10.0.9, and 11.0.0 ...
In Eclipse Jetty versions 9.4.0 thru 9.4.46, and 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, the parsing of the authority segment of an http scheme URI, the Jetty HttpURI class improperly detects an invalid input as a hostname. This can lead to failures in a Proxy scenario.
Scope: local
bookworm: resolved (fixed in 9.4.48-1)
bullseye: resolved (fixed in 9.4.39-3+deb11u1)
forky: resolved (fixed in 9.4.48-1)
sid: resolved (fixed in 9.4.48-1)
trixie: resolved (fixed in 9.4.48-1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/eclipse/jetty.project/security/advisories/GHSA-cj7v-27pg-wf7qhttps://lists.debian.org/debian-lts-announce/2022/08/msg00011.htmlhttps://security.netapp.com/advisory/ntap-20220901-0006/https://www.debian.org/security/2022/dsa-5198https://github.com/eclipse/jetty.project/security/advisories/GHSA-cj7v-27pg-wf7qhttps://lists.debian.org/debian-lts-announce/2022/08/msg00011.htmlhttps://security.netapp.com/advisory/ntap-20220901-0006/https://www.debian.org/security/2022/dsa-5198
2022-07-07
Published