| Package | Affected versions | Patched versions |
|---|---|---|
| org.eclipse.jetty:jetty-http | ≥ 10.0.0, < 10.0.10≥ 11.0.0, < 11.0.10< 9.4.47 | 10.0.1011.0.109.4.47 |
| jetty | ≥ 10.0.0, < 10.0.9≥ 11.0.0, ≤ 11.0.9< 9.4.46 | 10.0.99.4.46 |
URI use within Jetty's HttpURI class can parse invalid URIs such as http://localhost;/path as having an authority with a host of localhost;.
A URIs of the type http://localhost;/path should be interpreted to be either invalid or as localhost; to be the userinfo and no host.
However, HttpURI.host returns localhost; which is definitely wrong.
This can lead to errors with Jetty's HttpClient, and Jetty's ProxyServlet / AsyncProxyServlet / AsyncMiddleManServlet wrongly interpreting an authority with no host as one with a host.
Patched in PR #8146 for Jetty version 9.4.47. Patched in PR #8014 for Jetty versions 10.0.10, and 11.0.10
None.
If you have any questions or comments about this advisory:
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free