fix(cve): 修复 CVE-2025-11143 在 jetty 中的漏洞-jetty-AtomGit

Closed

fix(cve): 修复 CVE-2025-11143 在 jetty 中的漏洞 #104

infra_teamAdd on Jun 15Closed at 27 days agoMerged frominfra_team/jetty： fix-CVE-2025-11143-master into src-openeuler/jetty： master

fix(cve): 修复 CVE-2025-11143 在 jetty 中的漏洞 #104

Closed

infra_teamAdd on Jun 15Closed at 27 days ago

Merged frominfra_team/jetty fix-CVE-2025-11143-masterintosrc-openeuler/jetty master

Total: 2 files changed+110-1

ACVE-2025-11143.patch+106-0

@@ -0,0 +1,106 @@
	1	+diff --git a/jetty-util/src/main/java/org/eclipse/jetty/util/URIUtil.java b/jetty-util/src/main/java/org/eclipse/jetty/util/URIUtil.java
	2	+index 0000000..1234567 100644
	3	+--- a/jetty-util/src/main/java/org/eclipse/jetty/util/URIUtil.java
	4	++++ b/jetty-util/src/main/java/org/eclipse/jetty/util/URIUtil.java
	5	+@@ -21,6 +21,7 @@
	6	+
	7	+ package org.eclipse.jetty.util;
	8	+
	9	++import java.net.InetAddress;
	10	+ import java.net.URI;
	11	+ import java.net.URISyntaxException;
	12	+ import java.nio.charset.Charset;
	13	+@@ -1128,6 +1129,76 @@ public class URIUtil
	14	+ }
	15	+ return false;
	16	+ }
	17	+
	18	++ private static boolean isHexDigit(char c)
	19	++ {
	20	++ return (((c >= 'a') && (c <= 'f')) \|\| // ALPHA (lower)
	21	++ ((c >= 'A') && (c <= 'F')) \|\| // ALPHA (upper)
	22	++ ((c >= '0') && (c <= '9')));
	23	++ }
	24	++
	25	++ /**
	26	++ * Validate an IPv4 or IPv6 address.
	27	++ * @param inetAddress the address to validate
	28	++ * @throws IllegalArgumentException if the address is not valid
	29	++ */
	30	++ public static void validateInetAddress(String inetAddress)
	31	++ {
	32	++ try
	33	++ {
	34	++ InetAddress.getByName(inetAddress);
	35	++ }
	36	++ catch (Throwable e)
	37	++ {
	38	++ throw new IllegalArgumentException("Bad [IPv6] address: " + inetAddress, e);
	39	++ }
	40	++ }
	41	++
	42	++ /**
	43	++ * Validate and normalize the scheme.
	44	++ *
	45	++ * @param scheme The scheme to validate
	46	++ * @return The normalized version of the scheme
	47	++ * @throws IllegalArgumentException If the scheme is not valid
	48	++ */
	49	++ public static String validateScheme(String scheme)
	50	++ {
	51	++ if (scheme == null \|\| scheme.isEmpty())
	52	++ throw new IllegalArgumentException("Bad scheme");
	53	+
	54	++ // scheme = ALPHA *( ALPHA / DIGIT / "+" / "-" / "." )
	55	++ StringBuilder toLowerCase = null;
	56	++ for (int i = 0; i < scheme.length(); i++)
	57	++ {
	58	++ char c = scheme.charAt(i);
	59	++ if (c >= 'A' && c <= 'Z')
	60	++ {
	61	++ if (toLowerCase == null)
	62	++ {
	63	++ toLowerCase = new StringBuilder(scheme.length());
	64	++ toLowerCase.append(scheme, 0, i);
	65	++ }
	66	++ toLowerCase.append(Character.toLowerCase(c));
	67	++ }
	68	++ else if (c >= 'a' && c <= 'z' \|\|
	69	++ (i > 0 && (c >= '0' && c <= '9' \|\|
	70	++ c == '.' \|\|
	71	++ c == '+' \|\|
	72	++ c == '-')))
	73	++ {
	74	++ if (toLowerCase != null)
	75	++ toLowerCase.append(c);
	76	++ }
	77	++ else
	78	++ {
	79	++ throw new IllegalArgumentException("Bad scheme");
	80	++ }
	81	++ }
	82	++
	83	++ return toLowerCase == null ? scheme : toLowerCase.toString();
	84	++ }
	85	++
	86	+ }
	87	+diff --git a/jetty-http/src/main/java/org/eclipse/jetty/http/HttpURI.java b/jetty-http/src/main/java/org/eclipse/jetty/http/HttpURI.java
	88	+index 0000000..1234567 100644
	89	+--- a/jetty-http/src/main/java/org/eclipse/jetty/http/HttpURI.java
	90	++++ b/jetty-http/src/main/java/org/eclipse/jetty/http/HttpURI.java
	91	+@@ -493,7 +493,7 @@ public class HttpURI implements Serializable
	92	+ case ':':
	93	+ // must have been a scheme
	94	+- _scheme = uri.substring(mark, i);
	95	++ _scheme = URIUtil.validateScheme(uri.substring(mark, i));
	96	+ // Start again with scheme set
	97	+ state = State.START;
	98	+ break;
	99	+@@ -622,6 +622,7 @@ public class HttpURI implements Serializable
	100	+ case ']':
	101	+ c = uri.charAt(++i);
	102	+ _host = uri.substring(mark, i);
	103	++ URIUtil.validateInetAddress(_host);
	104	+ if (c == ':')
	105	+ {
	106	+ mark = i + 1;

Mjetty.spec+4-1

	@@ -50,7 +50,7 @@
50		50
51	Name: jetty	51	Name: jetty
52	Version: 9.4.58	52	Version: 9.4.58
53	-Release: 2	53	+Release: 3
54	Summary: Java Webserver and Servlet Container	54	Summary: Java Webserver and Servlet Container
55		55
56	# Jetty is dual licensed under both ASL 2.0 and EPL 1.0, see NOTICE.txt	56	# Jetty is dual licensed under both ASL 2.0 and EPL 1.0, see NOTICE.txt
	@@ -68,6 +68,7 @@ Patch1: 0001-Distro-jetty.home.patch
68	Patch2: 0002-Port-to-servlet-api-4-5.patch	68	Patch2: 0002-Port-to-servlet-api-4-5.patch
69	Patch3: CVE-2026-2332.patch	69	Patch3: CVE-2026-2332.patch
70	Patch4: CVE-2026-5795.patch	70	Patch4: CVE-2026-5795.patch
		71	+Patch5: CVE-2025-11143.patch
71		72
72	BuildRequires: maven-local-openjdk21	73	BuildRequires: maven-local-openjdk21
73	BuildRequires: mvn(javax.servlet:javax.servlet-api)	74	BuildRequires: mvn(javax.servlet:javax.servlet-api)
	@@ -973,6 +974,8 @@ install -m0644 -D jetty.sysusers.conf %{buildroot}%{_sysusersdir}/jetty.conf
973	%license LICENSE NOTICE.txt LICENSE-MIT	974	%license LICENSE NOTICE.txt LICENSE-MIT
974		975
975	%changelog	976	%changelog
		977	+* Mon Jun 15 2026 infra_team <zhaiwenjie1@huawei.com> - 9.4.58-3
		978	+- Fix CVE-2025-11143: URI Parser validation bypass
976	* Wed Apr 29 2026 yaoxin <1024769339@qq.com> - 9.4.58-2	979	* Wed Apr 29 2026 yaoxin <1024769339@qq.com> - 9.4.58-2
977	- Fix CVE-2026-2332 and CVE-2026-5795	980	- Fix CVE-2026-2332 and CVE-2026-5795
978		981