CVE-2018-12545

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2018-12545
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-12545.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2018-12545
Aliases
Downstream
Published
2019-03-27T20:29:03.630Z
Modified
2026-07-08T05:53:17.257582013Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

In Eclipse Jetty version 9.3.x and 9.4.x, the server is vulnerable to Denial of Service conditions if a remote client sends either large SETTINGs frames container containing many settings, or many small SETTINGs frames. The vulnerability is due to the additional CPU and memory allocations required to handle changed settings.

Database specific 
{
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "9.3.0-20150601"
                },
                {
                    "last_affected": "9.3.0-20150601"
                },
                {
                    "introduced": "9.3.0-20150601"
                },
                {
                    "last_affected": "9.3.0-20150601"
                }
            ],
            "cpes": [
                "cpe:2.3:a:eclipse:jetty:9.3.0:20150601:*:*:*:*:*:*"
            ],
            "vendor_product": "eclipse:jetty",
            "source": "CPE_STRING"
        },
        {
            "source": "CPE_STRING",
            "cpes": [
                "cpe:2.3:o:fedoraproject:fedora:28:*:*:*:*:*:*:*"
            ],
            "vendor_product": "fedoraproject:fedora",
            "extracted_events": [
                {
                    "introduced": "28"
                },
                {
                    "last_affected": "28"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/jetty/jetty.project

Affected ranges

Type
GIT
Repo
https://github.com/jetty/jetty.project
Events
Introduced
da11e86bccbcbd65a72012543c114a0af8a86d6f
Last affected
1f9703cf836af6c70ac0665fbc6790c0a8229a7a
Database specific 
{
    "cpe": [
        "cpe:2.3:a:eclipse:jetty:9.3.0:20150601:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:jetty:9.3.0:20150608:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:jetty:9.3.0:20150612:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:jetty:9.3.0:maintenance0:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:jetty:9.3.0:maintenance1:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:jetty:9.3.0:maintenance2:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:jetty:9.3.0:rc0:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:jetty:9.3.0:rc1:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:jetty:9.3.1:20150714:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:jetty:9.3.2:20150730:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:jetty:9.3.3:20150825:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:jetty:9.3.3:20150827:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:jetty:9.3.4:20151005:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:jetty:9.3.4:20151007:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:jetty:9.3.4:rc0:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:jetty:9.3.4:rc1:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:jetty:9.3.5:20151012:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:jetty:9.3.6:20151106:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:jetty:9.3.7:20160115:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:jetty:9.3.7:rc0:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:jetty:9.3.7:rc1:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:jetty:9.3.8:20160311:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:jetty:9.3.8:20160314:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:jetty:9.3.8:rc0:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:jetty:9.3.9:20160517:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:jetty:9.3.9:maintenance_0:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:jetty:9.3.9:maintenance_1:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:jetty:9.3.10:20160621:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:jetty:9.3.10:maintenance_0:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:jetty:9.3.11:20160721:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:jetty:9.3.11:maintenance_0:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:jetty:9.3.12:20160915:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:jetty:9.3.13:20161014:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:jetty:9.3.13:maintenance_0:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:jetty:9.3.14:20161028:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:jetty:9.3.15:20161220:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:jetty:9.3.16:20170119:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:jetty:9.3.16:20170120:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:jetty:9.3.17:20170317:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:jetty:9.3.17:rc0:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:jetty:9.3.18:20170406:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:jetty:9.3.19:20170502:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:jetty:9.3.20:20170531:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:jetty:9.3.21:20170918:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:jetty:9.3.21:maintenance_0:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:jetty:9.3.21:rc0:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:jetty:9.3.22:20171030:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:jetty:9.3.23:20180228:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:jetty:9.3.24:20180605:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:jetty:9.4.0:20161207:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:jetty:9.4.0:20161208:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:jetty:9.4.0:20180619:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:jetty:9.4.0:maintenance_0:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:jetty:9.4.0:maintenance_1:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:jetty:9.4.0:rc0:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:jetty:9.4.0:rc1:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:jetty:9.4.0:rc2:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:jetty:9.4.0:rc3:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:jetty:9.4.1:20170120:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:jetty:9.4.1:20180619:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:jetty:9.4.2:20170220:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:jetty:9.4.2:20180619:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:jetty:9.4.3:20170317:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:jetty:9.4.3:20180619:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:jetty:9.4.4:20170410:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:jetty:9.4.4:20170414:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:jetty:9.4.4:20180619:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:jetty:9.4.5:20170502:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:jetty:9.4.5:20180619:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:jetty:9.4.6:20170531:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:jetty:9.4.6:20180619:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:jetty:9.4.7:20170914:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:jetty:9.4.7:20180619:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:jetty:9.4.7:rc0:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:jetty:9.4.8:20171121:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:jetty:9.4.8:20180619:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:jetty:9.4.9:20180320:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:jetty:9.4.10:20180503:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:jetty:9.4.10:rc0:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:jetty:9.4.10:rc1:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:jetty:9.4.11:20180605:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:jetty:9.4.12:rc0:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:jetty:9.4.12:rc1:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:jetty:9.4.12:rc2:*:*:*:*:*:*"
    ],
    "source": "CPE_STRING",
    "extracted_events": [
        {
            "introduced": "9.3.0-20150601"
        },
        {
            "last_affected": "9.3.0-20150601"
        },
        {
            "introduced": "9.3.0-20150608"
        },
        {
            "last_affected": "9.3.0-20150608"
        },
        {
            "introduced": "9.3.0-20150612"
        },
        {
            "last_affected": "9.3.0-20150612"
        },
        {
            "introduced": "9.3.0-maintenance0"
        },
        {
            "last_affected": "9.3.0-maintenance0"
        },
        {
            "introduced": "9.3.0-maintenance1"
        },
        {
            "last_affected": "9.3.0-maintenance1"
        },
        {
            "introduced": "9.3.0-maintenance2"
        },
        {
            "last_affected": "9.3.0-maintenance2"
        },
        {
            "introduced": "9.3.0-rc0"
        },
        {
            "last_affected": "9.3.0-rc0"
        },
        {
            "introduced": "9.3.0-rc1"
        },
        {
            "last_affected": "9.3.0-rc1"
        },
        {
            "introduced": "9.3.1-20150714"
        },
        {
            "last_affected": "9.3.1-20150714"
        },
        {
            "introduced": "9.3.2-20150730"
        },
        {
            "last_affected": "9.3.2-20150730"
        },
        {
            "introduced": "9.3.3-20150825"
        },
        {
            "last_affected": "9.3.3-20150825"
        },
        {
            "introduced": "9.3.3-20150827"
        },
        {
            "last_affected": "9.3.3-20150827"
        },
        {
            "introduced": "9.3.4-20151005"
        },
        {
            "last_affected": "9.3.4-20151005"
        },
        {
            "introduced": "9.3.4-20151007"
        },
        {
            "last_affected": "9.3.4-20151007"
        },
        {
            "introduced": "9.3.4-rc0"
        },
        {
            "last_affected": "9.3.4-rc0"
        },
        {
            "introduced": "9.3.4-rc1"
        },
        {
            "last_affected": "9.3.4-rc1"
        },
        {
            "introduced": "9.3.5-20151012"
        },
        {
            "last_affected": "9.3.5-20151012"
        },
        {
            "introduced": "9.3.6-20151106"
        },
        {
            "last_affected": "9.3.6-20151106"
        },
        {
            "introduced": "9.3.7-20160115"
        },
        {
            "last_affected": "9.3.7-20160115"
        },
        {
            "introduced": "9.3.7-rc0"
        },
        {
            "last_affected": "9.3.7-rc0"
        },
        {
            "introduced": "9.3.7-rc1"
        },
        {
            "last_affected": "9.3.7-rc1"
        },
        {
            "introduced": "9.3.8-20160311"
        },
        {
            "last_affected": "9.3.8-20160311"
        },
        {
            "introduced": "9.3.8-20160314"
        },
        {
            "last_affected": "9.3.8-20160314"
        },
        {
            "introduced": "9.3.8-rc0"
        },
        {
            "last_affected": "9.3.8-rc0"
        },
        {
            "introduced": "9.3.9-20160517"
        },
        {
            "last_affected": "9.3.9-20160517"
        },
        {
            "introduced": "9.3.9-maintenance_0"
        },
        {
            "last_affected": "9.3.9-maintenance_0"
        },
        {
            "introduced": "9.3.9-maintenance_1"
        },
        {
            "last_affected": "9.3.9-maintenance_1"
        },
        {
            "introduced": "9.3.10-20160621"
        },
        {
            "last_affected": "9.3.10-20160621"
        },
        {
            "introduced": "9.3.10-maintenance_0"
        },
        {
            "last_affected": "9.3.10-maintenance_0"
        },
        {
            "introduced": "9.3.11-20160721"
        },
        {
            "last_affected": "9.3.11-20160721"
        },
        {
            "introduced": "9.3.11-maintenance_0"
        },
        {
            "last_affected": "9.3.11-maintenance_0"
        },
        {
            "introduced": "9.3.12-20160915"
        },
        {
            "last_affected": "9.3.12-20160915"
        },
        {
            "introduced": "9.3.13-20161014"
        },
        {
            "last_affected": "9.3.13-20161014"
        },
        {
            "introduced": "9.3.13-maintenance_0"
        },
        {
            "last_affected": "9.3.13-maintenance_0"
        },
        {
            "introduced": "9.3.14-20161028"
        },
        {
            "last_affected": "9.3.14-20161028"
        },
        {
            "introduced": "9.3.15-20161220"
        },
        {
            "last_affected": "9.3.15-20161220"
        },
        {
            "introduced": "9.3.16-20170119"
        },
        {
            "last_affected": "9.3.16-20170119"
        },
        {
            "introduced": "9.3.16-20170120"
        },
        {
            "last_affected": "9.3.16-20170120"
        },
        {
            "introduced": "9.3.17-20170317"
        },
        {
            "last_affected": "9.3.17-20170317"
        },
        {
            "introduced": "9.3.17-rc0"
        },
        {
            "last_affected": "9.3.17-rc0"
        },
        {
            "introduced": "9.3.18-20170406"
        },
        {
            "last_affected": "9.3.18-20170406"
        },
        {
            "introduced": "9.3.19-20170502"
        },
        {
            "last_affected": "9.3.19-20170502"
        },
        {
            "introduced": "9.3.20-20170531"
        },
        {
            "last_affected": "9.3.20-20170531"
        },
        {
            "introduced": "9.3.21-20170918"
        },
        {
            "last_affected": "9.3.21-20170918"
        },
        {
            "introduced": "9.3.21-maintenance_0"
        },
        {
            "last_affected": "9.3.21-maintenance_0"
        },
        {
            "introduced": "9.3.21-rc0"
        },
        {
            "last_affected": "9.3.21-rc0"
        },
        {
            "introduced": "9.3.22-20171030"
        },
        {
            "last_affected": "9.3.22-20171030"
        },
        {
            "introduced": "9.3.23-20180228"
        },
        {
            "last_affected": "9.3.23-20180228"
        },
        {
            "introduced": "9.3.24-20180605"
        },
        {
            "last_affected": "9.3.24-20180605"
        },
        {
            "introduced": "9.4.0-20161207"
        },
        {
            "last_affected": "9.4.0-20161207"
        },
        {
            "introduced": "9.4.0-20161208"
        },
        {
            "last_affected": "9.4.0-20161208"
        },
        {
            "introduced": "9.4.0-20180619"
        },
        {
            "last_affected": "9.4.0-20180619"
        },
        {
            "introduced": "9.4.0-maintenance_0"
        },
        {
            "last_affected": "9.4.0-maintenance_0"
        },
        {
            "introduced": "9.4.0-maintenance_1"
        },
        {
            "last_affected": "9.4.0-maintenance_1"
        },
        {
            "introduced": "9.4.0-rc0"
        },
        {
            "last_affected": "9.4.0-rc0"
        },
        {
            "introduced": "9.4.0-rc1"
        },
        {
            "last_affected": "9.4.0-rc1"
        },
        {
            "introduced": "9.4.0-rc2"
        },
        {
            "last_affected": "9.4.0-rc2"
        },
        {
            "introduced": "9.4.0-rc3"
        },
        {
            "last_affected": "9.4.0-rc3"
        },
        {
            "introduced": "9.4.1-20170120"
        },
        {
            "last_affected": "9.4.1-20170120"
        },
        {
            "introduced": "9.4.1-20180619"
        },
        {
            "last_affected": "9.4.1-20180619"
        },
        {
            "introduced": "9.4.2-20170220"
        },
        {
            "last_affected": "9.4.2-20170220"
        },
        {
            "introduced": "9.4.2-20180619"
        },
        {
            "last_affected": "9.4.2-20180619"
        },
        {
            "introduced": "9.4.3-20170317"
        },
        {
            "last_affected": "9.4.3-20170317"
        },
        {
            "introduced": "9.4.3-20180619"
        },
        {
            "last_affected": "9.4.3-20180619"
        },
        {
            "introduced": "9.4.4-20170410"
        },
        {
            "last_affected": "9.4.4-20170410"
        },
        {
            "introduced": "9.4.4-20170414"
        },
        {
            "last_affected": "9.4.4-20170414"
        },
        {
            "introduced": "9.4.4-20180619"
        },
        {
            "last_affected": "9.4.4-20180619"
        },
        {
            "introduced": "9.4.5-20170502"
        },
        {
            "last_affected": "9.4.5-20170502"
        },
        {
            "introduced": "9.4.5-20180619"
        },
        {
            "last_affected": "9.4.5-20180619"
        },
        {
            "introduced": "9.4.6-20170531"
        },
        {
            "last_affected": "9.4.6-20170531"
        },
        {
            "introduced": "9.4.6-20180619"
        },
        {
            "last_affected": "9.4.6-20180619"
        },
        {
            "introduced": "9.4.7-20170914"
        },
        {
            "last_affected": "9.4.7-20170914"
        },
        {
            "introduced": "9.4.7-20180619"
        },
        {
            "last_affected": "9.4.7-20180619"
        },
        {
            "introduced": "9.4.7-rc0"
        },
        {
            "last_affected": "9.4.7-rc0"
        },
        {
            "introduced": "9.4.8-20171121"
        },
        {
            "last_affected": "9.4.8-20171121"
        },
        {
            "introduced": "9.4.8-20180619"
        },
        {
            "last_affected": "9.4.8-20180619"
        },
        {
            "introduced": "9.4.9-20180320"
        },
        {
            "last_affected": "9.4.9-20180320"
        },
        {
            "introduced": "9.4.10-20180503"
        },
        {
            "last_affected": "9.4.10-20180503"
        },
        {
            "introduced": "9.4.10-rc0"
        },
        {
            "last_affected": "9.4.10-rc0"
        },
        {
            "introduced": "9.4.10-rc1"
        },
        {
            "last_affected": "9.4.10-rc1"
        },
        {
            "introduced": "9.4.11-20180605"
        },
        {
            "last_affected": "9.4.11-20180605"
        },
        {
            "introduced": "9.4.12-rc0"
        },
        {
            "last_affected": "9.4.12-rc0"
        },
        {
            "introduced": "9.4.12-rc1"
        },
        {
            "last_affected": "9.4.12-rc1"
        },
        {
            "introduced": "9.4.12-rc2"
        },
        {
            "last_affected": "9.4.12-rc2"
        }
    ]
}

Affected versions

9.*
9.3.0-20150601
9.3.0-20150608
9.3.0-20150612
9.3.0-maintenance0
9.3.0-maintenance1
9.3.0-maintenance2
9.3.0-rc0
9.3.0-rc1
9.3.1-20150714
9.3.10-20160621
9.3.10-maintenance_0
9.3.11-20160721
9.3.11-maintenance_0
9.3.12-20160915
9.3.13-20161014
9.3.13-maintenance_0
9.3.14-20161028
9.3.15-20161220
9.3.16-20170119
9.3.16-20170120
9.3.17-20170317
9.3.17-rc0
9.3.18-20170406
9.3.19-20170502
9.3.2-20150730
9.3.20-20170531
9.3.21-20170918
9.3.21-maintenance_0
9.3.21-rc0
9.3.22-20171030
9.3.23-20180228
9.3.24-20180605
9.3.3-20150825
9.3.3-20150827
9.3.4-20151005
9.3.4-20151007
9.3.4-rc0
9.3.4-rc1
9.3.5-20151012
9.3.6-20151106
9.3.7-20160115
9.3.7-rc0
9.3.7-rc1
9.3.8-20160311
9.3.8-20160314
9.3.8-rc0
9.3.9-20160517
9.3.9-maintenance_0
9.3.9-maintenance_1
9.4.0-20161207
9.4.0-20161208
9.4.0-20180619
9.4.0-maintenance_0
9.4.0-maintenance_1
9.4.0-rc0
9.4.0-rc1
9.4.0-rc2
9.4.0-rc3
9.4.1-20170120
9.4.1-20180619
9.4.10-20180503
9.4.10-rc0
9.4.10-rc1
9.4.11-20180605
9.4.12-rc0
9.4.12-rc1
9.4.12-rc2
9.4.2-20170220
9.4.2-20180619
9.4.3-20170317
9.4.3-20180619
9.4.4-20170410
9.4.4-20170414
9.4.4-20180619
9.4.5-20170502
9.4.5-20180619
9.4.6-20170531
9.4.6-20180619
9.4.7-20170914
9.4.7-20180619
9.4.7-rc0
9.4.8-20171121
9.4.8-20180619
9.4.9-20180320

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-12545.json"