Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Cherry pick to Jetty 9.4.x 8014 review httprequest uri #8146

Merged
merged 1 commit into from
Jun 8, 2022

Conversation

sbordet
Copy link
Contributor

@sbordet sbordet commented Jun 8, 2022

Now always adding a "/" before the path, if not already present.
Parse CONNECT URIs as Authority

Co-authored-by: Greg Wilkins gregw@webtide.com
(cherry picked from commit d1e64f4)

Now always adding a "/" before the path, if not already present.
Parse CONNECT URIs as Authority

Co-authored-by: Greg Wilkins <gregw@webtide.com>
(cherry picked from commit d1e64f4)
@sbordet sbordet requested a review from joakime June 8, 2022 19:40
@joakime joakime changed the title Cheery pick to Jetty 9.4.x 8014 review httprequest uri Cherry pick to Jetty 9.4.x 8014 review httprequest uri Jun 8, 2022
@sbordet sbordet merged commit 4ca8afb into jetty-9.4.x Jun 8, 2022
@sbordet sbordet deleted the jetty-9.4.x-8014-review-httprequest-uri branch June 8, 2022 20:59
HyukjinKwon pushed a commit to apache/spark that referenced this pull request Jul 9, 2022
…4.48.v20220622

### What changes were proposed in this pull request?
Upgrade `jetty-http` from 9.4.46.v20220331 to 9.4.48.v20220622

### Why are the changes needed?
[Release note](https://github.com/eclipse/jetty.project/releases)

[CVE-2022-2047](https://nvd.nist.gov/vuln/detail/CVE-2022-2047)

Info from Github dependabot

### Invalid URI parsing may produce invalid HttpURI.authority

### Description
URI use within Jetty's `HttpURI` class can parse invalid URIs such as `http://localhost;/path` as having an authority with a host of `localhost;`.

A URIs of the type `http://localhost;/path` should be interpreted to be either invalid or as `localhost;` to be the userinfo and no host.
However, `HttpURI.host` returns `localhost;` which is definitely wrong.

### Impact
This can lead to errors with Jetty's `HttpClient`, and Jetty's `ProxyServlet` / `AsyncProxyServlet` / `AsyncMiddleManServlet` wrongly interpreting an authority with no host as one with a host.

### Patches
Patched in PR jetty/jetty.project#8146 for Jetty version 9.4.47.
Patched in PR jetty/jetty.project#8015 for Jetty versions 10.0.10, and 11.0.10

### Workarounds
None.

### For more information
If you have any questions or comments about this advisory:

Email us at [securitywebtide.com](mailto:securitywebtide.com)."

### Does this PR introduce _any_ user-facing change?
No.

### How was this patch tested?
Pass GA

Closes #37142 from bjornjorgensen/jetty-http-9.4.48.v20220622.

Lead-authored-by: Bjørn Jørgensen <bjornjorgensen@gmail.com>
Co-authored-by: Bjorn Jorgensen <bjornjorgensen@gmail.com>
Signed-off-by: Hyukjin Kwon <gurwls223@apache.org>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants