GHSA-h2f4-v4c4-6wx4

Suggest an improvement
Source
https://github.com/advisories/GHSA-h2f4-v4c4-6wx4
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/03/GHSA-h2f4-v4c4-6wx4/GHSA-h2f4-v4c4-6wx4.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-h2f4-v4c4-6wx4
Aliases
Published
2019-03-28T18:33:38Z
Modified
2024-02-19T05:52:03.950097Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Uncontrolled Resource Consumption in org.eclipse.jetty:jetty-server
Details

In Eclipse Jetty version 9.3.x and 9.4.x, the server is vulnerable to Denial of Service conditions if a remote client sends either large SETTINGs frames container containing many settings, or many small SETTINGs frames. The vulnerability is due to the additional CPU and memory allocations required to handle changed settings.

Database specific 
{
    "nvd_published_at": null,
    "cwe_ids": [
        "CWE-400"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2020-06-16T21:38:26Z"
}
References

Affected packages

Maven / org.eclipse.jetty:jetty-server

Package

Name
org.eclipse.jetty:jetty-server
View open source insights on deps.dev
Purl
pkg:maven/org.eclipse.jetty/jetty-server

Affected ranges

Type
ECOSYSTEM
Events
Introduced
9.4.0
Fixed
9.4.12.v20180830

Affected versions

9.*

9.4.0.v20161208
9.4.0.v20180619
9.4.1.v20170120
9.4.1.v20180619
9.4.2.v20170220
9.4.2.v20180619
9.4.3.v20170317
9.4.3.v20180619
9.4.4.v20170414
9.4.4.v20180619
9.4.5.v20170502
9.4.5.v20180619
9.4.6.v20170531
9.4.6.v20180619
9.4.7.RC0
9.4.7.v20170914
9.4.7.v20180619
9.4.8.v20171121
9.4.8.v20180619
9.4.9.v20180320
9.4.10.RC0
9.4.10.RC1
9.4.10.v20180503
9.4.11.v20180605
9.4.12.RC0
9.4.12.RC1
9.4.12.RC2

Database specific 

{
    "last_known_affected_version_range": "<= 9.4.12.RC2"
}

Maven / org.eclipse.jetty:jetty-server

Package

Name
org.eclipse.jetty:jetty-server
View open source insights on deps.dev
Purl
pkg:maven/org.eclipse.jetty/jetty-server

Affected ranges

Type
ECOSYSTEM
Events
Introduced
9.3.0
Fixed
9.3.25.v20180904

Affected versions

9.*

9.3.0.v20150612
9.3.1.v20150714
9.3.2.v20150730
9.3.3.v20150827
9.3.4.RC0
9.3.4.RC1
9.3.4.v20151007
9.3.5.v20151012
9.3.6.v20151106
9.3.7.RC0
9.3.7.RC1
9.3.7.v20160115
9.3.8.RC0
9.3.8.v20160314
9.3.9.M0
9.3.9.M1
9.3.9.v20160517
9.3.10.M0
9.3.10.v20160621
9.3.11.M0
9.3.11.v20160721
9.3.12.v20160915
9.3.13.M0
9.3.13.v20161014
9.3.14.v20161028
9.3.15.v20161220
9.3.16.v20170120
9.3.17.RC0
9.3.17.v20170317
9.3.18.v20170406
9.3.19.v20170502
9.3.20.v20170531
9.3.21.M0
9.3.21.RC0
9.3.21.v20170918
9.3.22.v20171030
9.3.23.v20180228
9.3.24.v20180605

Database specific 

{
    "last_known_affected_version_range": "<= 9.3.24.v20180605"
}