fix: updated dependencies to fix CVEs

[aswinayyolath]

Summary

updated jetty version to 9.4.57.v20241219 to address CVE-2024-13009
updated netty version to 4.1.122.Final to address CVE-2025-24970, CVE-2025-25193, CVE-2024-47535

Categorization

• security/CVE

This PR resolves #2277

[katlim-br]

+1

[aswinayyolath]

@CCisGG could you pls take a look?

[CCisGG]

Running internal checks. Will merge once they all passes.

[CCisGG]

@aswinayyolath Got some errors here:

org.eclipse.jetty:jetty-http:9.4.57.v20241219
Notes: Vulnerability found and is blocked by oss-canary: vulnerability: ## Summary Eclipse Jetty is a lightweight, highly scalable, Java-based web server and Servlet engine . It includes a utility class, `HttpURI`, for URI/URL parsing. The `HttpURI` class does insufficient validation on the authority segment of a URI. However the behaviour of `HttpURI` differs from the common browsers in how it handles a URI that would be considered invalid if fully validated against the RRC. Specifically `HttpURI` and the browser may differ on the value of the host extracted from an invalid URI and thus a combination of Jetty and a vulnerable browser may be vulnerable to a open redirect attack or to a SSRF attack if the URI is used after passing validation checks. ## Details ### Affected components The vulnerable component is the `HttpURI` class when used as a utility class in an application. The Jetty usage of the class is not vulnerable. ### Attack overview The `HttpURI` class does not well validate the authority section of a URI. When presented with an illegal authority that may contain user info (eg username:password#@hostname:port), then the parsing of the URI is not failed. Moreover, the interpretation of what part of the authority is the host name differs from a common browser in that they also do not fail, but they select a different host name from the illegal URI. ### Attack scenario A typical attack scenario is illustrated in the diagram below. The Validator checks whether the attacker-supplied URL is on the blocklist. If not, the URI is passed to the Requester for redirection. The Requester is responsible for sending requests to the hostname specified by the URI. This attack occurs when the Validator is the `org.eclipse.jetty.http.HttpURI` class and the Requester is the `Browser` (include chrome, firefox and Safari). An attacker can send a malformed URI to the Validator (e.g., `http://browser.check%23%40vulndetector.com/` ). After validation, the Validator finds that the hostname is not on the blocklist. However, the Requester can still send requests to the domain with the hostname `vulndetector.com`. ## PoC payloads: ``` http://browser.check &@vulndetector.com/ http://browser.check #@vulndetector.com/ http://browser.check?@vulndetector.com/ http://browser.check#@vulndetector.com/ http://vulndetector.com\\/ ``` The problem of 302 redirect parsing in HTML tag scenarios. Below is a poc example. After clicking the button, the browser will open "browser.check", and jetty will parse this URL as "vulndetector.com". ``` <a href="http://browser.check#@vulndetector.com/"></a> ``` A comparison of the parsing differences between Jetty and chrome is shown in the table below (note that neither should accept the URI as valid). | Invalid URI | Jetty | Chrome | | ---------------------------------------------- | ---------------- | ------------- | | http://browser.check &@vulndetector.com/ | vulndetector.com | browser.check | | http://browser.check #@vulndetector.com/ | vulndetector.com | browser.check | | http://browser.check?@vulndetector.com/ | vulndetector.com | browser.check | | http://browser.check#@vulndetector.com/ | vulndetector.com | browser.check | The problem of 302 redirect parsing in HTTP 302 Location | Input | Jetty | Chrome | | ------------------------ | -------------- | ------------- | | http://browser.check%5c/ | browser.check\ | browser.check | It is noteworthy that Spring Web also faced similar security vulnerabilities, being affected by the aforementioned four types of payloads. These issues have since been resolved and have been assigned three CVE numbers [3-5]. ## Impact The impact of this vulnerability is limited to developers that use the Jetty HttpURI directly. Example: your project implemented a blocklist to block on some hosts based on HttpURI's handling of authority section. The vulnerability will help attackers bypass the protections that developers have set up for hosts. The vulnerability will lead to **SSRF**[1] and **URL Redirection**[2] vulnerabilities in several cases. ## Mitigation The attacks outlined above rely on decoded user data being passed to the `HttpURI` class. Application should not pass decoded user data as an encoded URI to any URI class/method, including `HttpURI`. Such applications are likely to be vulnerable in other ways. The immediate solution is to upgrade to a version of the class that will fully validate the characters of the URI authority. Ultimately, Jetty will deprecate and remove support for user info in the authority per [RFC9110 Section 4.2.4](https://datatracker.ietf.org/doc/html/rfc9110#section-4.2.4). Note that the Chrome (and other browsers) parse the invalid user info section improperly as well (due to flawed WhatWG URL parsing rules that do not apply outside of a Web Browser). ## Reference [1] https://cwe.mitre.org/data/definitions/918.html [2] https://cwe.mitre.org/data/definitions/601.html remediation: Refer to the links for remediation. vulnerability: ## Summary Eclipse Jetty is a lightweight, highly scalable, Java-based web server and Servlet engine . It includes a utility class, `HttpURI`, for URI/URL parsing. The `HttpURI` class does insufficient validation on the authority segment of a URI. However the behaviour of `HttpURI` differs from the common browsers in how it handles a URI that would be considered invalid if fully validated against the RRC. Specifically `HttpURI` and the browser may differ on the value of the host extracted from an invalid URI and thus a combination of Jetty and a vulnerable browser may be vulnerable to a open redirect attack or to a SSRF attack if the URI is used after passing validation checks. ## Details ### Affected components The vulnerable component is the `HttpURI` class when used as a utility class in an application. The Jetty usage of the class is not vulnerable. ### Attack overview The `HttpURI` class does not well validate the authority section of a URI. When presented with an illegal authority that may contain user info (eg username:password#@hostname:port), then the parsing of the URI is not failed. Moreover, the interpretation of what part of the authority is the host name differs from a common browser in that they also do not fail, but they select a different host name from the illegal URI. ### Attack scenario A typical attack scenario is illustrated in the diagram below. The Validator checks whether the attacker-supplied URL is on the blocklist. If not, the URI is passed to the Requester for redirection. The Requester is responsible for sending requests to the hostname specified by the URI. This attack occurs when the Validator is the `org.eclipse.jetty.http.HttpURI` class and the Requester is the `Browser` (include chrome, firefox and Safari). An attacker can send a malformed URI to the Validator (e.g., `http://browser.check%23%40vulndetector.com/` ). After validation, the Validator finds that the hostname is not on the blocklist. However, the Requester can still send requests to the domain with the hostname `vulndetector.com`. ## PoC payloads: ``` http://browser.check &@vulndetector.com/ http://browser.check #@vulndetector.com/ http://browser.check?@vulndetector.com/ http://browser.check#@vulndetector.com/ http://vulndetector.com\\/ ``` The problem of 302 redirect parsing in HTML tag scenarios. Below is a poc example. After clicking the button, the browser will open "browser.check", and jetty will parse this URL as "vulndetector.com". ``` <a href="http://browser.check#@vulndetector.com/"></a> ``` A comparison of the parsing differences between Jetty and chrome is shown in the table below (note that neither should accept the URI as valid). | Invalid URI | Jetty | Chrome | | ---------------------------------------------- | ---------------- | ------------- | | http://browser.check &@vulndetector.com/ | vulndetector.com | browser.check | | http://browser.check #@vulndetector.com/ | vulndetector.com | browser.check | | http://browser.check?@vulndetector.com/ | vulndetector.com | browser.check | | http://browser.check#@vulndetector.com/ | vulndetector.com | browser.check | The problem of 302 redirect parsing in HTTP 302 Location | Input | Jetty | Chrome | | ------------------------ | -------------- | ------------- | | http://browser.check%5c/ | browser.check\ | browser.check | It is noteworthy that Spring Web also faced similar security vulnerabilities, being affected by the aforementioned four types of payloads. These issues have since been resolved and have been assigned three CVE numbers [3-5]. ## Impact The impact of this vulnerability is limited to developers that use the Jetty HttpURI directly. Example: your project implemented a blocklist to block on some hosts based on HttpURI's handling of authority section. The vulnerability will help attackers bypass the protections that developers have set up for hosts. The vulnerability will lead to **SSRF**[1] and **URL Redirection**[2] vulnerabilities in several cases. ## Mitigation The attacks outlined above rely on decoded user data being passed to the `HttpURI` class. Application should not pass decoded user data as an encoded URI to any URI class/method, including `HttpURI`. Such applications are likely to be vulnerable in other ways. The immediate solution is to upgrade to a version of the class that will fully validate the characters of the URI authority. Ultimately, Jetty will deprecate and remove support for user info in the authority per [RFC9110 Section 4.2.4](https://datatracker.ietf.org/doc/html/rfc9110#section-4.2.4). Note that the Chrome (and other browsers) parse the invalid user info section improperly as well (due to flawed WhatWG URL parsing rules that do not apply outside of a Web Browser). ## Reference [1] https://cwe.mitre.org/data/definitions/918.html [2] https://cwe.mitre.org/data/definitions/601.html remediation: Upgrade org.eclipse.jetty:jetty-http from 9.4.57.v20241219 to 12.0.12 to fix the vulnerability.

[aswinayyolath]

Hmm Okay, to resolve this we need a major version bump for jetty from 9.4.57.v20241219 to 12.0.12 , that might be disruptive. Let me check

[JvD-Ericsson]

Hey @aswinayyolath any update on this? Upgrading from 9.4.57.v20241219 to 12.0.12 requires upgrading Java to 17. Not sure if you have had a look at that already.

[aswinayyolath]

No, I haven't looked into it yet.

[JvD-Ericsson]

I can have a look myself. I am looking to resolve these CVEs

[aswinayyolath]

Yeah, sure

[kyguy]

Upgrading from 9.4.57.v20241219 to 12.0.12 requires upgrading Java to 17. Not sure if you have had a look at that already.

Can we piggy-back on the PR here [1]

[1] #2248

[CCisGG]

@kyguy Thanks for the reminder. I merged the java 17 PR.

[kyguy]

I have been looking into fixing some CVEs in cruise-control and noticed that jetty-http 9.4.56.v20240826 would need to be updated to 12.012

Hey @JvD-Ericsson, how is the jetty upgrade to 12.0.12 going? Are there any further changes required?

[JvD-Ericsson]

Hey @kyguy, yeah there are a good few changes that need to be made to get jetty 12.0.12 working correctly, mainly to do with servlet security so, just trying to sort those out right now

[stecurran-est]

Hi @aswinayyolath, I could manage the netty update to v. 4.1.118.Final under #2292 while jetty update is being progressed. Would that be suitable?

[aswinayyolath]

That looks okay to me.

[stecurran-est]

netty updated to v. 4.1.118.Final under #2292 [merged]

[JvD-Ericsson]

I have a review up for upgrading jetty to 12.0.12 #2307. Jetty 12 only supports Java 17+ so the Java 11 build and test will fail. Please review if you have time.