-
Notifications
You must be signed in to change notification settings - Fork 499
[GHSA-qh8g-58pp-2wxh] Eclipse Jetty URI parsing of invalid authority #5475
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[GHSA-qh8g-58pp-2wxh] Eclipse Jetty URI parsing of invalid authority #5475
Conversation
|
Hi there @joakime! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository. This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory |
|
it also needs to be affected:
was having a hard getting the syntax plgged in there correctly |
|
Hi there @joakime! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository. This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory |
|
@rhuddleston the fix is not in released Jetty versions earlier than 12.0.12. The linked to Issue (jetty/jetty.project#12874) is not a fix for that vulnerability, it is a HTTP Spec compliance addition that only applies to Jetty's HttpClient use cases. (the fix for the CVE in Jetty 12.0.12 fixes Jetty Server use cases as well) |
|
When I clicked on that commit it has: Added a UriCompliance.Violation.USER_INFO to deprecate user info in HttpURI (jetty/jetty.project#12012) and pull 12012 refers to that CVE so I guess I assumed wrong. |
|
That link is a spec compliance change and CVE fix for 12.0.x The link you posted is not a CVE fix for older versions of Jetty. Also, as a different note, this CVE is managed by the Eclipse CNA. |
|
One last thing. |
Updates
Comments
This fix was backported to Jetty 10 & 11: jetty/jetty.project#12874