[GHSA-qh8g-58pp-2wxh] Eclipse Jetty URI parsing of invalid authority

[ap00rv]

Updates

• Affected products
• CVSS v3

Comments
The fixed version should also include 9.4.57.v20241219.

See jetty/jetty.project#12532 linked in release notes: https://github.com/jetty/jetty.project/releases/tag/jetty-9.4.57.v20241219

[github]

Hi there @joakime! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory

[Copilot]

Copilot wasn't able to review any files in this pull request.

Files not reviewed (1)

• advisories/github-reviewed/2024/10/GHSA-qh8g-58pp-2wxh/GHSA-qh8g-58pp-2wxh.json: Language not supported

[joakime]

Close this.

That is not a backport of the CVE in the sense that it fixes the CVE for the older EOL versions of Jetty.
That is a partial backport for narrow subset of the CVE on a sponsored release for an EOL version of Jetty.

See past PRs that incorrectly attempted to update this advisory for details.

• [GHSA-qh8g-58pp-2wxh] Eclipse Jetty URI parsing of invalid authority #5496 (lots of details here to read)
• [GHSA-qh8g-58pp-2wxh] Eclipse Jetty URI parsing of invalid authority #5475
• [GHSA-qh8g-58pp-2wxh] Eclipse Jetty URI parsing of invalid authority #5222
• [GHSA-qh8g-58pp-2wxh] Eclipse Jetty URI parsing of invalid authority #5210

[joakime]

For the record, Jetty 9 / Jetty 10 / and Jetty 11 are all EOL now.

• EOL (End of Life) for Jetty 9 - January 2025 jetty/jetty.project#7958
• EOL (End of Life) for Jetty 10 / Jetty 11 - January 2025 jetty/jetty.project#10485