Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Defect Jetty 11.x and 10.x End of Life checks #37

Open
alt3kx opened this issue Aug 21, 2022 · 0 comments
Open

Defect Jetty 11.x and 10.x End of Life checks #37

alt3kx opened this issue Aug 21, 2022 · 0 comments

Comments

@alt3kx
Copy link

alt3kx commented Aug 21, 2022

Defect Jetty 11.x and 10.x End of Life checks
The Jetty EoL check does not work correctly. It only checks for the major version and thus generates a scan issue for Jetty 11.X.X and 10.X.X

Tested on Burp Pro version:
-Tested J2EEScan-1.2.6-jar-with-dependencies.jar version
J2EEScan1

-Tested public J2EEScan-2.0.1-dev-jar-with-dependencies.jar version
J2EEScan2

Defect Jetty 11.x.x
Defect11

Defect Jetty 10.x.x
Defect10

Defect 9.4.48,v202206.22 <= 9.4.x is now EoL References
https://github.com/eclipse/jetty.project/releases
https://www.eclipse.org/jetty/download.php

9 4 48

/**
* Jetty
*/
if (software.equalsIgnoreCase("Jetty")) {
/**
* End of Life - Jetty
*/
if ( Integer.parseInt(release.substring(0, 1)) < 9 ) {
callbacks.addScanIssue(new CustomScanIssue(
baseRequestResponse.getHttpService(),
requestInfo.getUrl(),
baseRequestResponse,
"End of Life Software - Jetty " + release,
"J2EEScan identified an unsupported release of Jetty <b>" + release + "</b>.<br />"
+ "No more security updates for this version will be released by the vendor <br /><br />"
+ "<b>References</b><br />"
+ "https://wiki.eclipse.org/Jetty/Starting/Jetty_Version_Comparison_Table<br />",
"Update the Jetty Container with the last stable release",
Risk.High,
Confidence.Certain
));
}
}

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant