Improve SSLConnection buffers handling (CVE-2022-2191)

[lorban]

Jetty version(s)
10+

Description
SSLConnection's buffers utilization and their pooling should be reviewed.

Fixes Security Advisory
GHSA-8mpp-f3f7-xc28
CVE-2022-2191

[joakime]

In light of discoveries during this review, a better combined ByteBufferPool with easier to configure setup was just merged in PR #8171, due for the next Jetty 10.0.x release.

[AB-xdev]

Does this also affect Jetty 9.x?

According to the issue description this is only relevant for Jetty 10+ but the advisory says <= 10.0.9 which also includes version 9.x.

[lorban]

No, it does not affect any 9.4.x version.

[joakime]

According to the issue description this is only relevant for Jetty 10+ but the advisory says <= 10.0.9 which also includes version 9.x.

Good catch!

We'll update the advisory version range.

[kadinwu]

affected versions in github advisories [(https://github.com/advisories/GHSA-8mpp-f3f7-xc28)] has < 10.0.10.
does it really affect 9.x versions?

[joakime]

affected versions in github advisories GHSA-8mpp-f3f7-xc28 has < 10.0.10.
does it really affect 9.x versions?

See prior comments, and our advisory (the master database at github has not been updated yet):

• Improve SSLConnection buffers handling (CVE-2022-2191) #8161 (comment)
• Improve SSLConnection buffers handling (CVE-2022-2191) #8161 (comment)
• GHSA-8mpp-f3f7-xc28

Also, Jetty 9.4.x is now at End of Community Support, you are strongly encouraged to upgrade to Jetty 10+ as soon as possible.

See:

• EoCS (End of Community Support) for Jetty 9 - June 2022 #7958

[joakime]

The github advisory database version of CVE-2022-2191 has its version range updated.
GHSA-8mpp-f3f7-xc28