Skip to content

Commit 8eb8dfb

Browse files
Add CVE-2024-6763 to known (#1037)
1 parent b683844 commit 8eb8dfb

File tree

1 file changed

+8
-0
lines changed

1 file changed

+8
-0
lines changed

.security/known_cves.yml

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,3 +15,11 @@
1515
* the application is deployed as a WAR or with an embedded Servlet container * ... and so on.
1616
The Dumper tools distributes as Jar only, Spring MVC is not used in the code.
1717
There is no dependency on Spring MVC in the Dumper tools.
18+
19+
- CVE: CVE-2024-6763
20+
artifact: org.eclipse.jetty:jetty-http:9.4.58.v20250814
21+
justification: >
22+
The Dumper is a CLI app, not a public-facing web server. It does not accept or process arbitrary URIs from untrusted
23+
external users. The attack vector for CVE-2024-6763 requires an attacker to supply
24+
a malformed URI to be parsed by the server; The Dumper does not expose an interface for such input.
25+

0 commit comments

Comments
 (0)