Eclipse Jetty Vulnerability CVE-2022-2047 CVE-2022-2048 

Issue date: 21-09-2022
Affects versions: 15.1, 14.7, 13.4

Security Issue ID

SECURITY-347

 

Affected Product Version(s)

15.1.0, 14.7.8, 13.4.18, and all previous versions

Severity 

Medium

Description

CVE-2022-2047

A flaw was found in Eclipse Jetty. When parsing the authority segment of an HTTP scheme URI, the Jetty HttpURI class improperly detects an invalid input as a hostname. This can lead to failures in a Proxy scenario.

CVE-2022-2048

In Eclipse Jetty HTTP/2 server implementation, when encountering an invalid HTTP/2 request, the error handling has a bug that can wind up not properly cleaning up the active connections and associated resources. This can lead to a Denial of Service scenario where there are no enough resources left to process good requests.

The problems have been recognized and patched. The fix is available in version 9.4.47.

Instructions

Customers are recommended to upgrade to the latest version. As of the time of writing, 15.1.1, 14.7.9 or 13.4.19