Eclipse Jetty HTTP URI Parsing Vulnerability in Jetty 9 - 11
Summary
CVE-2022-2047: In Eclipse Jetty versions 9.4.0 thru 9.4.46, and 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, the parsing of the authority segment of an http scheme URI, the Jetty HttpURI class improperly detects an invalid inpu... Affects jetty9 across 3 version ranges.
< 9.4.39-3+deb11u1
>= b9645a17373e4e9b7f30b6c0a07defcea2cb660b, < a9eaf8d5d73369acf610ce88f850c0d56c4b1113
< bc17a0369a11ecf40bb92c839b9ef0a8ac50ea18
Fixed in 9.4.39-3+deb11u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Eclipse Jetty is a widely used open-source Java-based web server and servlet container. It is known for its scalability and performance, making it a popular choice for serving Java applications. Jetty supports HTTP/2 and WebSocket protocols, and it is often embedded in applications. However, versions 9.4.0 through 9.4.46, 10.0.0 through 10.0.9, and 11.0.0 through 11.0.9 contain a vulnerability in the HttpURI class that improperly detects invalid input as a hostname, potentially leading to failures in proxy scenarios.
Vulnerability Detail
The vulnerability, identified as CVE-2022-2047, arises from the way the Jetty HttpURI class parses the authority segment of an HTTP scheme URI. This improper detection can allow an attacker to exploit the issue in a proxy scenario, leading to potential service disruptions or misrouting of requests. The vulnerability affects multiple versions of Jetty, making it critical for users to address it promptly.
How To Fix
Minimum fixed version
9.4.39-3+deb11u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade jetty9Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can implement additional validation of the URI inputs before they are processed by the Jetty server. This can help mitigate the risk of invalid hostnames being accepted.
Conclusion
CVE-2022-2047 is a significant vulnerability in Eclipse Jetty that affects multiple versions of the software. Users are strongly encouraged to upgrade to the fixed versions to mitigate potential risks. Additionally, implementing workarounds can provide temporary relief until an upgrade is possible.
See every vulnerability recorded for jetty9 →
FAQ
CVE-2022-2047 is a vulnerability in Eclipse Jetty that affects the parsing of HTTP URIs, potentially leading to failures in proxy scenarios.
The affected versions include Jetty 9.4.0 through 9.4.46, 10.0.0 through 10.0.9, and 11.0.0 through 11.0.9.
The vulnerability can lead to service disruptions and misrouting of requests in proxy scenarios.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The CVSS score of CVE-2022-2047 is 2.7, indicating a low severity level.
Related vulnerabilities
Recent vulnerabilities recorded for jetty9.
