CVE-2022-2191 and jetty-io@9.4.48.v20220622

[Horcrux7]

I get today a security warning from the org.owasp:dependency-check-gradle tool for the library jetty-io@9.4.48.v20220622 that it include affected form CVE-2022-2191.

The description of CVE-2022-2191 suggest that the version 9.x is not affected. Also there is no newer 9.x version.

In Eclipse Jetty versions 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, SslConnection does not release ByteBuffers from configured ByteBufferPool in case of error code paths.

Is this security warning a false positive? Or will this not fixed in version 9.x because EOL?

[joakime]

See prior comments, and our advisory (the master database at github has not been updated yet):

• Improve SSLConnection buffers handling (CVE-2022-2191) #8161 (comment) (comment about bad version range)
• Improve SSLConnection buffers handling (CVE-2022-2191) #8161 (comment) (comment about 9.4.x)
• GHSA-8mpp-f3f7-xc28 (master advisory at jetty project)

Also, Jetty 9.4.x is now at End of Community Support, you are strongly encouraged to upgrade to Jetty 10+ as soon as possible.

See:

• End of Community Support for Jetty 9.x - June 2022 #7958