jfrog / jfrog/artifactory-client-java

False positive reported on Jetty CVE-2025-5115 — version is at fix version

Open
#448 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Java
Stars
331
Forks
163
Avg merge
20h 9m
Merged PRs (30d)
1

Description

Describe the bug
Xray reports CVE-2025-5115 against org.eclipse.jetty:jetty-server:9.4.58. This CVE affects Jetty ≤9.4.57. The fix version is 9.4.58 — which is exactly our version. We are patched.

To Reproduce
Xray scan a software containing jetty-server 9.4.58 and see CVE-2025-5115 reported. This CVE was fixed in 9.4.58.

Expected behavior
CVE-2025-5115 should not be reported for Jetty >= 9.4.58, as 9.4.58 is the fix version.

Versions

  • Package: org.eclipse.jetty:jetty-server:9.4.58
  • Vulnerable range: ≤9.4.57
  • Fix version: 9.4.58

Additional context
Advisory: https://github.com/jetty/jetty.project/security/advisories/GHSA-mmxm-8w33-wc4h

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reviewing the CVE-2025-5115 advisory linked in the issue and the Xray scan behavior for org.eclipse.jetty:jetty-server:9.4.58. The issue mentions no repository file, test, or entry point, so first determine whether the fix belongs in this Java client or in Xray; done means versions at or above 9.4.58 are no longer reported.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.