[GHSA-qh8g-58pp-2wxh] Eclipse Jetty URI parsing of invalid authority

[levpachmanov]

Updates

• Affected products
• CVSS v3

Comments
The fix for this advisory (commit db8bb7a8631aafc7897032b133a5b425854e5841, PR jetty/jetty.project#12532, "Fix CVE-2024-6763") was independently backported to each maintenance branch, not fixed only at 12.0.12.

Verified via git tag --contains db8bb7a8631aafc7897032b133a5b425854e5841 against jetty/jetty.project, and independently by diffing HttpURI.java from each release's sources jar on Maven Central against the pre/post-fix code (presence of Violation.USER_INFO / isUnreservedPctEncodedOrSubDelim and the hardened authority-state validation logic).

Per-branch first-fixed versions

Branch	First fixed version	Confirmed still vulnerable
9.4.x	9.4.57.v20241219	9.4.51.v20230217, 9.4.53.v20231009, 9.4.56.v20240826
10.0.x	10.0.26	10.0.19, 10.0.22
11.0.x	11.0.26	11.0.23, 11.0.24
12.0.x	12.0.12	(as currently stated)

Suggested vulnerable_version_range entries

Replace the single range with four, one per branch:

• >= 7.0.0, < 9.4.57.v20241219 → patched 9.4.57.v20241219
• >= 10.0.0, < 10.0.26 → patched 10.0.26
• >= 11.0.0, < 11.0.26 → patched 11.0.26
• >= 12.0.0, <= 12.0.11 → patched 12.0.12

Why this matters

The current single range >= 7.0.0, <= 12.0.11 implies every 9.4.x/10.0.x/11.0.x release up to that point remains vulnerable, but releases on those branches at or after the versions above already contain the fix. Recommend splitting into the four ranges above so scanners don't flag already-patched maintenance-branch releases.

[github]

Hi there @joakime! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory

[joakime]

Reject.

This is not fixed in the EOL releases of Jetty 9, Jetty 10, or Jetty 11.
It CANNOT be fixed in Jetty 9, Jetty 10, or Jetty 11, as they are on older RFCs with regards to HTTP that require the authority to be present, even in the bad/confusing/illegal ways.
Only Jetty 12 can have this fix, as it's on the latest RFC that removes support for the authority.

See past PRs on here for details.

• https://github.com/github/advisory-database/pulls?q=is%3Apr+GHSA-qh8g-58pp-2wxh
• [GHSA-qh8g-58pp-2wxh] Eclipse Jetty URI parsing of invalid authority #6537
• [GHSA-qh8g-58pp-2wxh] Eclipse Jetty URI parsing of invalid authority #5210
• [GHSA-qh8g-58pp-2wxh] Eclipse Jetty URI parsing of invalid authority #5222
• [GHSA-qh8g-58pp-2wxh] Eclipse Jetty URI parsing of invalid authority #5475
• [GHSA-qh8g-58pp-2wxh] Eclipse Jetty URI parsing of invalid authority #5496
• [GHSA-qh8g-58pp-2wxh] Eclipse Jetty URI parsing of invalid authority #5507