CVE-2022-2047: Input Validation
A flaw was found in Eclipse Jetty. When parsing the authority segment of an HTTP scheme URI, the Jetty HttpURI class improperly detects an invalid input as a hostname. This issue can lead to failures in a Proxy scenario.
Other sources
Eclipse Jetty could allow a remote authenticated attacker to bypass security restrictions, caused by a flaw in the HttpURI class. By sending a specially-crafted request, an attacker could exploit this vulnerability to the HttpClient and ProxyServlet/AsyncProxyServlet/AsyncMiddleManServlet wrongly interpreting an authority with no host as one with a host.
— IBM
In Eclipse Jetty versions 9.4.0 thru 9.4.46, and 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, the parsing of the authority segment of an http scheme URI, the Jetty HttpURI class improperly detects an invalid input as a hostname. This can lead to failures in a Proxy scenario.
Affected Software
Remediation
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2022-2047?
The severity of CVE-2022-2047 is low with a severity value of 2.7.
Which versions of Eclipse Jetty are affected by CVE-2022-2047?
Eclipse Jetty versions 9.4.0 thru 9.4.46, 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 are affected by CVE-2022-2047.
What is the impact of CVE-2022-2047?
CVE-2022-2047 can lead to failures in a Proxy scenario due to the improper detection of an invalid input as a hostname.
How can I fix CVE-2022-2047?
Update Eclipse Jetty to version 9.4.47, 10.0.10, or 11.0.10 to fix CVE-2022-2047.
Where can I find more information about CVE-2022-2047?
You can find more information about CVE-2022-2047 at the following references: [CVE-2022-2047](https://www.cve.org/CVERecord?id=CVE-2022-2047), [NVD](https://nvd.nist.gov/vuln/detail/CVE-2022-2047), [GitHub Advisory](https://github.com/eclipse/jetty.project/security/advisories/GHSA-cj7v-27pg-wf7q), [Red Hat Bugzilla](https://bugzilla.redhat.com/show_bug.cgi?id=2116949), [Red Hat Advisory](https://access.redhat.com/errata/RHSA-2023:1661).