Evaluation of Embedded Jetty Vulnerabilities

Products

CA Process Automation Base Process Automation Manager

Issue/Introduction

Customers using CA IT Process Automation Manager (ITPAM) 4.4 CP04 have reported that security audit scanners (e.g., Qualys, Nessus) continue to flag the embedded Eclipse Jetty 9.4.56 component with vulnerabilities. These audit findings typically request an upgrade to Jetty 9.4.57 or higher to mitigate reported CVEs related to HTTP/2 stream handling.

Environment

Product: CA IT Process Automation Manager (ITPAM)
Version: 4.4.00
Cumulative Patch: CP04
Embedded Component: Eclipse Jetty 9.4.56

Cause

Security scanners identify vulnerabilities based on the version of the third-party library (Jetty) detected in the environment. Specifically, several reported vulnerabilities pertain to Jetty's HTTP/2 stream-handling engine.

Resolution

Broadcom Product Development has evaluated these findings and determined that the reported vulnerabilities are not exploitable within the ITPAM architecture.

Technical Analysis

WebSocket vs. HTTP: ITPAM utilizes the embedded Jetty component specifically for WebSocket communication rather than standard HTTP web traffic.
Protocol Usage: WebSockets utilize the older HTTP/1.1 protocol. Because the reported vulnerabilities are localized within Jetty's HTTP/2 stream-handling engine, the risk to ITPAM is essentially zero.
False Positive Status: Due to the internal implementation that bypasses the affected HTTP/2 logic, these scanner findings should be treated as False Positives or residual risk for compliance purposes.

Support Recommendation

Manual Upgrades: Broadcom does not support or recommend the manual replacement or upgrade of embedded third-party libraries (such as jetty-*.jar files). Doing so may lead to application instability and is not a supported configuration.
Compliance Statement: This article serves as the official vendor position for audit remediation. The current embedded version in ITPAM 4.4 CP04 is considered secure for its intended use case within the product.

Broadcom continues to monitor third-party library updates and will include newer versions of Jetty in future Cumulative Patches (CPs) or major releases as part of the standard product lifecycle maintenance.

Additional Information

Relevant vulnerabilities:

CVE-2025-5115: HTTP/2 client may trigger the server to send RST_STREAM frames, including those that are malformed or should not be sent in a particular stream state, potentially forcing the server to consume resources such as CPU and memory.

CVE-2024-13009: In Eclipse Jetty versions 9.4.0 to 9.4.56 a buffer can be incorrectly released when confronted with a gzip error when inflating a request body. This can result in corrupted and/or inadvertent sharing of data between requests.

Jetty will also be updated in a future release of PAM, release TBD.