Fix CVE-2024-6763 #12532
Fix CVE-2024-6763 #12532
Conversation
Back port the fix for [CVE-2024-6763](GHSA-qh8g-58pp-2wxh). Better validation of authority in HttpURI. No known exploits.
| @@ -36,6 +36,7 @@ public enum HttpComplianceSection | |||
| NO_AMBIGUOUS_PATH_SEPARATORS("https://tools.ietf.org/html/rfc3986#section-3.3", "No ambiguous URI path separators"), | |||
| NO_AMBIGUOUS_PATH_PARAMETERS("https://tools.ietf.org/html/rfc3986#section-3.3", "No ambiguous URI path parameters"), | |||
| NO_UTF16_ENCODINGS("https://www.w3.org/International/iri-edit/draft-duerst-iri.html#anchor29", "UTF16 encoding"), | |||
| NO_USER_INFO("https://datatracker.ietf.org/doc/html/rfc9110#name-deprecation-of-userinfo-in-", "User info in authority"), | |||
There was a problem hiding this comment.
Weird place for this, but oh well, it is Jetty 9.x ...
|
Hi, do we know when this fix will be released? |
Jetty-9.4 is end-of-open-support, so the timing of the release will depend on our commercial clients. Having said that, we typically start release cycles at the end of the month, with releases available early in the next month (although thanksgiving might put us back a week this month). So it is plausible that it will be released in the next few weeks. Note that the jetty server itself is in no way vulnerable, it is only if you are using jetty classes as a library. This back port was more about silencing reporting tools rather than fixing an actual vulnerability |
lachlan-roberts
added
the
Sponsored
Back port the fix for CVE-2024-6763.
Better validation of authority in HttpURI. No known exploits.