CVE-2022-2047: Input Validation
A flaw was found in Eclipse Jetty. When parsing the authority segment of an HTTP scheme URI, the Jetty HttpURI class improperly detects an invalid input as a hostname. This issue can lead to failures in a Proxy scenario.
Other sources
In Eclipse Jetty versions 9.4.0 thru 9.4.46, and 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, the parsing of the authority segment of an http scheme URI, the Jetty HttpURI class improperly detects an invalid input as a hostname. This can lead to failures in a Proxy scenario.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/jetty9to a version that resolves this vulnerability.Fixed in 9.4.50-4+deb10u1Fixed in 9.4.39-3+deb11u2Fixed in 9.4.50-4+deb11u1Fixed in 9.4.50-4+deb12u1Fixed in 9.4.50-4+deb12u2Fixed in 9.4.53-1 - Upgrade
Upgrade
redhat/jetty-httpto a version that resolves this vulnerability.Fixed in 9.4.47 - Upgrade
Upgrade
redhat/jetty-httpto a version that resolves this vulnerability.Fixed in 10.0.10 - Upgrade
Upgrade
redhat/jetty-httpto a version that resolves this vulnerability.Fixed in 11.0.10 - Upgrade
Upgrade
debian/jetty9to a version that resolves this vulnerability.Fixed in 9.4.50-4+deb10u1 - Upgrade
Upgrade
debian/jetty9to a version that resolves this vulnerability.Fixed in 9.4.39-3+deb11u2 - Upgrade
Upgrade
debian/jetty9to a version that resolves this vulnerability.Fixed in 9.4.50-4+deb11u1 - Upgrade
Upgrade
debian/jetty9to a version that resolves this vulnerability.Fixed in 9.4.50-4+deb12u1 - Upgrade
Upgrade
debian/jetty9to a version that resolves this vulnerability.Fixed in 9.4.50-4+deb12u2 - Upgrade
Upgrade
debian/jetty9to a version that resolves this vulnerability.Fixed in 9.4.53-1
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2022-2047?
The severity of CVE-2022-2047 is low with a severity value of 2.7.
Which versions of Eclipse Jetty are affected by CVE-2022-2047?
Eclipse Jetty versions 9.4.0 thru 9.4.46, 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 are affected by CVE-2022-2047.
What is the impact of CVE-2022-2047?
CVE-2022-2047 can lead to failures in a Proxy scenario due to the improper detection of an invalid input as a hostname.
How can I fix CVE-2022-2047?
Update Eclipse Jetty to version 9.4.47, 10.0.10, or 11.0.10 to fix CVE-2022-2047.
Where can I find more information about CVE-2022-2047?
You can find more information about CVE-2022-2047 at the following references: [CVE-2022-2047](https://www.cve.org/CVERecord?id=CVE-2022-2047), [NVD](https://nvd.nist.gov/vuln/detail/CVE-2022-2047), [GitHub Advisory](https://github.com/eclipse/jetty.project/security/advisories/GHSA-cj7v-27pg-wf7q), [Red Hat Bugzilla](https://bugzilla.redhat.com/show_bug.cgi?id=2116949), [Red Hat Advisory](https://access.redhat.com/errata/RHSA-2023:1661).