For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and/or bypass some security constraints. This is a variation of the vulnerability reported in CVE-2021-28164/GHSA-v7ff-8wcx-gmc5.

Affected: Maven: org.eclipse.jetty:jetty-webapp

### Description URIs can be crafted using some encoded characters to access the content of the `WEB-INF` directory and/or bypass some security constraints. This is a variation of the vulnerability reported in [CVE-2021-28164](https://nvd.nist.gov/vuln/detail/CVE-2021-28164)/[GHSA-v7ff-8wcx-gmc5](https://github.com/eclipse/jetty.project/security/advisories/GHSA-v7ff-8wcx-gmc5).

### Impact The default compliance mode allows requests with URIs that contain a %u002e segment to access protected resources within the WEB-INF directory. For example, a request to `/%u002e/WEB-INF/web.xml` can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application. Similarly, an encoded null character can prevent correct normalization so that /.%00/WEB-INF/web.xml cal also retrieve the web.xml file.

### Workarounds Some Jetty [rewrite rules](https://www.eclipse.org/jetty/documentation/jetty-9/index.html#rewrite-handler) can be deployed to rewrite any request containing encoded dot segments or null characters in the raw request URI, to a known not found resource: ```xml <Call name="addRule"> <Arg> <New class="org.eclipse.jetty.rewrite.handler.RewriteRegexRule"> <Set name="regex">.*/(?:\.+/)+.*</Set> <Set name="replacement">/WEB-INF/Not-Found</Set> </New> </Arg> </Call> <Call name="addRule"> <Arg> <New class="org.eclipse.jetty.rewrite.handler.ValidUrlRule"/> </Arg> </Call> ```

### Analysis Prior to 9.4.37, Je…

Security update for jetty-minimal

apache-httpclient: incorrect handling of malformed authority component in request URIs jetty: request containing multiple Accept headers with a large number of "quality" parameters may lead to DoS Broker: discloses JDBC username and password in the application log file 7: Incorrect privilege in Management Console resteasy: Error message exposes endpoint class information netty: Information disclosure via the local system temporary directory netty: possible request smuggling in HTTP/2 due missing validation netty: Request smuggling via content-length header jetty: Symlink directory exposes webapp directory contents jetty: Ambiguous paths can access WEB-INF jetty: Resource exhaustion when receiving an invalid large TLS frame jetty: requests to the ConcatServlet and WelcomeFilter are able to access protected resources within the WEB-INF directory apache-commons-io: Limited path traversal in Apache Commons IO 2.2 to 2.6 jetty: SessionListener can prevent a session from being invalidated breaking logout jetty: crafted URIs allow bypassing security constraints

Security update for jetty-minimal

Affected: Ubuntu:16.04:LTS: jetty9, Ubuntu:22.04:LTS: jetty9

For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and/or bypass some security constraints. This is a variation of the vulnerability reported in CVE-2021-28164/GHSA-v7ff-8wcx-gmc5.

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Eclipse Jetty ausnutzen, um Sicherheitsvorkehrungen zu umgehen.