Описание
In Eclipse Jetty versions 9.4.0 thru 9.4.46, and 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, the parsing of the authority segment of an http scheme URI, the Jetty HttpURI class improperly detects an invalid input as a hostname. This can lead to failures in a Proxy scenario.
A flaw was found in Eclipse Jetty. When parsing the authority segment of an HTTP scheme URI, the Jetty HttpURI class improperly detects an invalid input as a hostname. This issue can lead to failures in a Proxy scenario.
Отчет
In Red Hat Satellite jetty was used to build index files to search documentation. Nowadays in Satellite 6.9 and 6.10 jetty dependency is not in use and there is no access to it, so there is no way this vulnerability can be exploitable. Therefore Satellite supported versions are not affected.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| A-MQ Clients 2 | jetty-http | Not affected | ||
| OpenShift Developer Tools and Services | jenkins | Affected | ||
| Red Hat build of Debezium 1 | jetty-http | Not affected | ||
| Red Hat build of Quarkus | jetty-http | Not affected | ||
| Red Hat Data Grid 8 | jetty-http | Not affected | ||
| Red Hat Decision Manager 7 | jetty-http | Out of support scope | ||
| Red Hat Fuse 7 | jetty-http | Not affected | ||
| Red Hat Integration Camel K 1 | jetty-http | Not affected | ||
| Red Hat Integration Camel Quarkus 1 | jetty-http | Not affected | ||
| Red Hat Integration Service Registry | jetty-http | Out of support scope |
Показывать по
Дополнительная информация
Статус:
EPSS
2.7 Low
CVSS3
Связанные уязвимости
In Eclipse Jetty versions 9.4.0 thru 9.4.46, and 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, the parsing of the authority segment of an http scheme URI, the Jetty HttpURI class improperly detects an invalid input as a hostname. This can lead to failures in a Proxy scenario.
In Eclipse Jetty versions 9.4.0 thru 9.4.46, and 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, the parsing of the authority segment of an http scheme URI, the Jetty HttpURI class improperly detects an invalid input as a hostname. This can lead to failures in a Proxy scenario.
In Eclipse Jetty versions 9.4.0 thru 9.4.46, and 10.0.0 thru 10.0.9, a ...
Jetty invalid URI parsing may produce invalid HttpURI.authority
Уязвимость контейнера сервлетов Eclipse Jetty, существующая из-за недостаточной проверки входных данных, позволяющая нарушителю привести к сбоям в сценарии прокси
EPSS
2.7 Low
CVSS3