[GHSA-qh8g-58pp-2wxh] Eclipse Jetty URI parsing of invalid authority

[dwaller]

Updates

• Affected products
• CVSS v3

Comments
CVE has been fixed in Jetty 9.4.57.v20241219, see commit on Nov 13, 2024 https://github.com/jetty/jetty.project/commits/jetty-9.4.57.v20241219/

[github]

Hi there @joakime! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory

[Copilot]

Copilot wasn't able to review any files in this pull request.

Files not reviewed (1)

• advisories/github-reviewed/2024/10/GHSA-qh8g-58pp-2wxh/GHSA-qh8g-58pp-2wxh.json: Language not supported

[joakime]

Duplicate of #5210

Reject.

This isn't the place to make this update. (This CVE is managed by the Eclipse Foundation)

We especially do not like this change to a EOL version of Jetty that NOBODY should be using now.

[joakime]

Reject.
See comment #5210 (comment)