VulnerabilityModified
CVE-2022-2047
In Eclipse Jetty versions 9.4.0 thru 9.4.46, and 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, the parsing of the authority segment of an http scheme URI, the Jetty HttpURI class improperly detects an invalid input as a hostname.
LOW 2.7EPSS 1.25%
Does this matter?
Lower severity and a low EPSS score (1.25%). Track it; it rarely justifies an emergency change on its own.
Description
In Eclipse Jetty versions 9.4.0 thru 9.4.46, and 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, the parsing of the authority segment of an http scheme URI, the Jetty HttpURI class improperly detects an invalid input as a hostname. This can lead to failures in a Proxy scenario.
- CVSS 3.1
- 2.7 LOWCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
- EPSS
- 1.25% probability · 68th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-20
- Affected
- eclipse/jetty · debian/debian linux · netapp/element plug-in for vcenter server · netapp/management services for element software and netapp hci · netapp/snapcenter · netapp/solidfire \& hci storage node · netapp/hci compute node
- Source
- emo@eclipse.org
References
- https://github.com/eclipse/jetty.project/security/advisories/GHSA-cj7v-27pg-wf7qPatch, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2022/08/msg00011.htmlMailing List, Third Party Advisory
- https://security.netapp.com/advisory/ntap-20220901-0006/Third Party Advisory
- https://www.debian.org/security/2022/dsa-5198Third Party Advisory
- https://github.com/eclipse/jetty.project/security/advisories/GHSA-cj7v-27pg-wf7qPatch, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2022/08/msg00011.htmlMailing List, Third Party Advisory
- https://security.netapp.com/advisory/ntap-20220901-0006/Third Party Advisory
- https://www.debian.org/security/2022/dsa-5198Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.