Описание
The Jetty URI parser has some key differences to other common parsers when evaluating invalid or unusual URIs. Differential parsing of URIs in systems using multiple components may result in security by-pass. For example a component that enforces a black list may interpret the URIs differently from one that generates a response. At the very least, differential parsing may divulge implementation details.
A flaw was found in org.eclipse.jetty. The Jetty URI parser handles invalid or unusual Uniform Resource Identifiers (URIs) differently compared to other common parsers. This discrepancy, known as differential parsing, can lead to security bypasses in systems that use multiple components to process URIs, such as when a blacklist enforcement component interprets a URI differently from a response generation component. At a minimum, this issue could unintentionally reveal internal system details.
Отчет
This vulnerability is rated as Low by Red Hat. Successful usage of this vulnerability is non-trivial, as the attacker must be able to craft a URI that exploits Jetty's differential parsing while bypassing other parsers (ex. in a firewall or load balancer). Additionally, divulging implementation details is possible but not guaranteed while also being indirect, meaning that an attacker may be able to obtain error messages or behavioral differences, but those are not guaranteed. As such, there is likely no direct leak of sensitive data.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| OpenShift Developer Tools and Services | jenkins | Out of support scope | ||
| OpenShift Developer Tools and Services | ocp-tools-4/jenkins-rhel8 | Out of support scope | ||
| OpenShift Developer Tools and Services | ocp-tools-4/jenkins-rhel9 | Out of support scope | ||
| Red Hat AMQ Broker 7 | jetty-http | Fix deferred | ||
| Red Hat build of Apache Camel 4 for Quarkus 3 | jetty-http | Out of support scope | ||
| Red Hat build of Apache Camel for Spring Boot 4 | jetty-http | Fix deferred | ||
| Red Hat build of Apache Camel - HawtIO 4 | jetty-http | Fix deferred | ||
| Red Hat build of Apicurio Registry 2 | jetty-http | Fix deferred | ||
| Red Hat build of Apicurio Registry 3 | jetty-http | Fix deferred | ||
| Red Hat build of Debezium 2 | jetty-http | Fix deferred |
Показывать по
Дополнительная информация
Статус:
3.7 Low
CVSS3
Связанные уязвимости
The Jetty URI parser has some key differences to other common parsers when evaluating invalid or unusual URIs. Differential parsing of URIs in systems using multiple components may result in security by-pass. For example a component that enforces a black list may interpret the URIs differently from one that generates a response. At the very least, differential parsing may divulge implementation details.
The Jetty URI parser has some key differences to other common parsers when evaluating invalid or unusual URIs. Differential parsing of URIs in systems using multiple components may result in security by-pass. For example a component that enforces a black list may interpret the URIs differently from one that generates a response. At the very least, differential parsing may divulge implementation details.
The Jetty URI parser has some key differences to other common parsers ...
org.eclipse.jetty:jetty-http has different parsing of invalid URIs
3.7 Low
CVSS3