In Eclipse Jetty versions 9.4.0 thru 9.4.46, and 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, the parsing of the authority segment of an http scheme URI, the Jetty HttpURI class improperly detects an invalid input as a hostname. This can lead to failures in a Proxy scenario.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In Eclipse Jetty versions 9.4.0 thru 9.4.46, and 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, the     parsing of the authority segment of an http scheme URI, the Jetty HttpURI class improperly detects an     invalid input as a hostname. This can lead to failures in a Proxy scenario. (CVE-2022-2047)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In Eclipse Jetty versions 9.4.0 thru 9.4.46, and 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, the
    parsing of the authority segment of an http scheme URI, the Jetty HttpURI class improperly detects an
    invalid input as a hostname. This can lead to failures in a Proxy scenario. (CVE-2022-2047)

The 19c and 21c versions of Oracle Database Server installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2022 CPU advisory.

  - Vulnerability in the Oracle Database - Machine Learning (Numpy) component of Oracle Database Server. The     supported version that is affected is 21c. Easily exploitable vulnerability allows low privileged attacker     having Create Session privilege with network access via Oracle Net to compromise Oracle Database - Machine     Learning (Numpy). (CVE-2021-41495)  

  - Vulnerability in the Spatial and Graph (jackson-databind) component of Oracle Database Server. Supported     versions that are affected are 19c and 21c. Easily exploitable vulnerability allows low privileged attacker     having Authenticated User privilege with network access via HTTP to compromise Spatial and     Graph (jackson-databind). Successful attacks of this vulnerability can result in unauthorized ability to     cause a hang or frequently repeatable crash (complete DOS) of Spatial and Graph (jackson-databind).
    (CVE-2020-36518)

  - Vulnerability in the Oracle Notification Server (PCRE2) component of Oracle Database Server. Supported     versions that are affected are 19c and 21c. Easily exploitable vulnerability allows low privileged     attacker having Subscriber privilege with network access via HTTP to compromise Oracle Notification     Server (PCRE2). Successful attacks of this vulnerability can result in unauthorized ability to cause     a hang or frequently repeatable crash (complete DOS) of Oracle Notification Server (PCRE2).
    Note: This vulnerability applies to Windows systems only. (CVE-2022-1587)

  - Vulnerability in the Oracle Database - Advanced Queuing component of Oracle Database Server. The supported     version that is affected is 19c. Easily exploitable vulnerability allows high privileged attacker having     DBA user privilege with network access via Oracle Net to compromise Oracle Database - Advanced Queuing.
    Successful attacks of this vulnerability can result in takeover of Oracle Database - Advanced Queuing.
    (CVE-2022-21596)

  - Vulnerability in the Oracle Database - Sharding component of Oracle Database Server. Supported versions     that are affected are 19c and 21c. Easily exploitable vulnerability allows high privileged attacker having     Local Logon privilege with network access via Local Logon to compromise Oracle Database - Sharding.
    Successful attacks of this vulnerability can result in takeover of Oracle Database - Sharding.
    (CVE-2022-21603)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3079 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3079-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                      Markus Koschany     August 22, 2022                               https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : jetty9     Version        : 9.4.16-0+deb10u2     CVE ID         : CVE-2022-2047 CVE-2022-2048

    Two security vulnerabilities were discovered in Jetty, a Java servlet engine     and webserver.

    CVE-2022-2047

        In Eclipse Jetty the parsing of the authority segment of an http scheme         URI, the Jetty HttpURI class improperly detects an invalid input as a         hostname. This can lead to failures in a Proxy scenario.

    CVE-2022-2048

        In Eclipse Jetty HTTP/2 server implementation, when encountering an invalid         HTTP/2 request, the error handling has a bug that can wind up not properly         cleaning up the active connections and associated resources. This can lead         to a Denial of Service scenario where there are no enough resources left to         process good requests.


    For Debian 10 buster, these problems have been fixed in version     9.4.16-0+deb10u2.

    We recommend that you upgrade your jetty9 packages.

    For the detailed security status of jetty9 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/jetty9

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: This is a digitally signed message part

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5198 advisory.

    Two security vulnerabilities were discovered in Jetty, a Java servlet engine and webserver. CVE-2022-2047     In Eclipse Jetty the parsing of the authority segment of an http scheme URI, the Jetty HttpURI class     improperly detects an invalid input as a hostname. This can lead to failures in a Proxy scenario.
    CVE-2022-2048 In Eclipse Jetty HTTP/2 server implementation, when encountering an invalid HTTP/2 request,     the error handling has a bug that can wind up not properly cleaning up the active connections and     associated resources. This can lead to a Denial of Service scenario where there are no enough resources     left to process good requests. For the stable distribution (bullseye), these problems have been fixed in     version 9.4.39-3+deb11u1. We recommend that you upgrade your jetty9 packages. For the detailed security     status of jetty9 please refer to its security tracker page at: https://security-     tracker.debian.org/tracker/jetty9

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
253083	Linux Distros Unpatched Vulnerability : CVE-2022-2047	Nessus	Misc.	low
413939	SCA: security update for org.eclipse.jetty:jetty-http (GHSA-cj7v-27pg-wf7q)	Tenable Cloud Security	SCA Checks	low
413939	SCA: security update for org.eclipse.jetty:jetty-http (GHSA-cj7v-27pg-wf7q)	Tenable Self-Hosted Container Security	SCA Checks	low
166370	Oracle Database Server (Oct 2022 CPU)	Nessus	Databases	critical
164323	Debian dla-3079 : jetty9 - security update	Nessus	Debian Local Security Checks	low
163753	Debian DSA-5198-1 : jetty9 - security update	Nessus	Debian Local Security Checks	low

Detections

Analytics

CVE-2022-2047

low

Tenable Plugins

low

low

low

critical

low

low