CVE-2024-6763

NameCVE-2024-6763
DescriptionEclipse Jetty is a lightweight, highly scalable, Java-based web server and Servlet engine . It includes a utility class, HttpURI, for URI/URL parsing. The HttpURI class does insufficient validation on the authority segment of a URI. However the behaviour of HttpURI differs from the common browsers in how it handles a URI that would be considered invalid if fully validated against the RRC. Specifically HttpURI and the browser may differ on the value of the host extracted from an invalid URI and thus a combination of Jetty and a vulnerable browser may be vulnerable to a open redirect attack or to a SSRF attack if the URI is used after passing validation checks.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs1085698

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
jetty (PTS)jessie, jessie (lts)6.1.26-4+deb8u2vulnerable
jetty8 (PTS)jessie, jessie (lts)8.1.16-4+deb8u1vulnerable
jetty9 (PTS)stretch (security), stretch (lts), stretch9.2.30-0+deb9u2vulnerable
buster (security), buster, buster (lts)9.4.50-4+deb10u2vulnerable
bullseye (security), bullseye9.4.50-4+deb11u2vulnerable
bookworm (security), bookworm9.4.50-4+deb12u3vulnerable
sid, trixie9.4.56-1vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
jettysourcejessie(unfixed)end-of-life
jettysource(unstable)(unfixed)
jetty8source(unstable)(unfixed)
jetty9sourcebuster(unfixed)end-of-life
jetty9source(unstable)(unfixed)1085698

Notes

https://github.com/jetty/jetty.project/security/advisories/GHSA-qh8g-58pp-2wxh
https://github.com/jetty/jetty.project/pull/12012

Search for package or bug name: Reporting problems