CVE in Jetty

[solonovamax]

Currently, there are 2 CVEs present in the version of Jetty used in Javalin 6.3.0.

• CVE-2024-6763
• CVE-2024-8184

The second CVE has been patched in the latest snapshot of Javalin, due to updating to Jetty from 11.0.22 -> 11.0.24, however no release has been made for this change.

Currently, the only fix for CVE-2024-6763 is to update to Jetty ≥12.0.12. Are there any plans to do this in the near future?

[zugazagoitia]

The impact of this vulnerability is limited to developers that use the Jetty HttpURI directly

I doubt we use it, but let's check

[solonovamax]

some downstream consumers may use it, as it is a dependency, and maven does not have a distinction between api & implementation dependencies like gradle does

[FlyingSheepOnSailfish]

For what it is worth, we are running Javalin 6.2.0 with Jetty 11.0.24

[dzikoysk]

jetty-server should be patched in the next Javalin version. It was supposed to be released a week ago, but there were some internal issues with @tipsy's pipeline.

For jetty-client we may not be able to get rid of this:

• Questions about CVE-2024-6763 in Jetty 10 jetty/jetty.project#12581
• Questions about CVE-2024-6763 in Jetty 11 jetty/jetty.project#12584

Like you said, it's not affecting us and the chance it's affecting our users is also pretty low - if you'd be digging that deep in the Jetty, you'd probably just use raw Jetty anyway, without Javalin:

That is an informational CVE, read it carefully.

The Jetty Server and Jetty Client on all releases of Jetty 12/11/10/9 are not vulnerable.

Only direct use of HttpURI in your own application, under VERY specific conditions, would you be vulnerable.
The only fix in that situation is to decide which URI/URL spec parsing your application wants to follow, and choose a URI parsing spec that makes sense for your application's needs.

~ jetty/jetty.project#12581 (comment)

We will most likely get rid of it in Javalin 8.x, with Jetty 12:

• Support for Jetty 12 #2067

[solonovamax]

hmmm, I see

tbh I just opened the issue because my ide was complaining lol