jetty-http v20241219 CVE Security vulnerabilities

[gangqiang01]

Jetty Version
v20241219
Jetty Environment

jetty9.4
Java Version
8
Question

CVE Security vulnerabilities how fixed

[gangqiang01]

How to solve jetty-http v20241219 security vulnerabilities

[lachlan-roberts]

Can you be more specific about what vulnerabilities you are referring to.

[gangqiang01]

Can you be more specific about what vulnerabilities you are referring to.

This vulnerability is identified through version scanning and there may be false positives.
The triggering of this vulnerability indeed relies on the use of the org.eclipse.jetty.http.HttpURL class. If it is determined through the code layer or runtime monitoring that the org.eclipse.jetty.http.HttpURL class is not loaded, then the reporting of this vulnerability through version detection is considered a false positive.
Eclipse Jetty is an open-source, Java-based web server and Java Servlet container of the Eclipse Foundation.
Versions 7.0.0 to 12.0.11 of Eclipse Jetty have a security vulnerability. This vulnerability stems from the insufficient validation of the authority part of the URI by the HttpURI class, which may lead to open redirect attacks or server-side request forgery attacks.

[gangqiang01]

Can you be more specific about what vulnerabilities you are referring to.

This vulnerability is identified through version scanning and there may be false positives. The triggering of this vulnerability indeed relies on the use of the org.eclipse.jetty.http.HttpURL class. If it is determined through the code layer or runtime monitoring that the org.eclipse.jetty.http.HttpURL class is not loaded, then the reporting of this vulnerability through version detection is considered a false positive. Eclipse Jetty is an open-source, Java-based web server and Java Servlet container of the Eclipse Foundation. Versions 7.0.0 to 12.0.11 of Eclipse Jetty have a security vulnerability. This vulnerability stems from the insufficient validation of the authority part of the URI by the HttpURI class, which may lead to open redirect attacks or server-side request forgery attacks.

GHSA-qh8g-58pp-2wxh This website is our solution. The only way is to upgrade the version of Jetty to 12. The 9.4.57.v20241219 version of Jetty-http cannot solve this vulnerability.

[joakime]

Duplicate of #12783

Nobody should be using Jetty 9.x anymore, it was End of Community Support 3 years ago.

• EoCS (End of Community Support) for Jetty 9 - June 2022 #7958