CVE-2018-12545
The Eclipse Foundation Eclipse Jetty
HIGH 7.5
At a glance
- Source
- NVD
- EPSS
- EPSS 5.12 % · percentile 92 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- eclipse
- NVD status
- Modified
Description
In Eclipse Jetty version 9.3.x and 9.4.x, the server is vulnerable to Denial of Service conditions if a remote client sends either large SETTINGs frames container containing many settings, or many small SETTINGs frames. The vulnerability is due to the additional CPU and memory allocations required to handle changed settings.
Weaknesses (CWE)
- CWE-400 — Uncontrolled Resource Consumption
- CWE-770 — Allocation of Resources Without Limits or Throttling
References
- https://lists.apache.org/thread.html/70744fe4faba8e2fa7e50a7fc794dd03cb28dad8b21e08ee59bb1606%40%3Cdevnull.infra.apache.org%3E
- https://lists.apache.org/thread.html/febc94ffec9275dcda64633e0276a1400cd318e571009e4cda9b7a79%40%3Cnotifications.accumulo.apache.org%3E
- https://lists.apache.org/thread.html/13f5241048ec0bf966a6ddd306feaf40de5b20e1f09096b9cddeddf2%40%3Ccommits.accumulo.apache.org%3E
- https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8%40%3Ccommits.pulsar.apache.org%3E
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CIS4LALKZNLF5X5IGNGRSKERG7FY4QG6/
- https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe%40%3Ccommits.druid.apache.org%3E
- https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://bugs.eclipse.org/bugs/show_bug.cgi?id=538096
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | MEDIUM 5.0 | AV:N/AC:L/Au:N/C:N/I:N/A:P | NVD · nvd@nist.gov (Primary) |
Advisories
- GHSA-h2f4-v4c4-6wx4 — Uncontrolled Resource Consumption in org.eclipse.jetty:jetty-server
European references
- ENISA EUVD · EUVD-2019-0383
- GCVE · GCVE-0-2018-12545
CERT-FR advisories
- CERTFR-2024-AVI-0923 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2023-AVI-0357 — Multiples vulnérabilités dans IBM Cognos · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:eclipse:jetty:9.3.0:20150601:*:*:*:*:*:*cpe:2.3:a:eclipse:jetty:9.3.0:20150608:*:*:*:*:*:*cpe:2.3:a:eclipse:jetty:9.3.0:20150612:*:*:*:*:*:*cpe:2.3:a:eclipse:jetty:9.3.0:maintenance0:*:*:*:*:*:*cpe:2.3:a:eclipse:jetty:9.3.0:maintenance1:*:*:*:*:*:*cpe:2.3:a:eclipse:jetty:9.3.0:maintenance2:*:*:*:*:*:*cpe:2.3:a:eclipse:jetty:9.3.0:rc0:*:*:*:*:*:*cpe:2.3:a:eclipse:jetty:9.3.0:rc1:*:*:*:*:*:*cpe:2.3:a:eclipse:jetty:9.3.1:20150714:*:*:*:*:*:*cpe:2.3:a:eclipse:jetty:9.3.2:20150730:*:*:*:*:*:*cpe:2.3:a:eclipse:jetty:9.3.3:20150825:*:*:*:*:*:*cpe:2.3:a:eclipse:jetty:9.3.3:20150827:*:*:*:*:*:*cpe:2.3:a:eclipse:jetty:9.3.4:20151005:*:*:*:*:*:*cpe:2.3:a:eclipse:jetty:9.3.4:20151007:*:*:*:*:*:*cpe:2.3:a:eclipse:jetty:9.3.4:rc0:*:*:*:*:*:*cpe:2.3:a:eclipse:jetty:9.3.4:rc1:*:*:*:*:*:*cpe:2.3:a:eclipse:jetty:9.3.5:20151012:*:*:*:*:*:*cpe:2.3:a:eclipse:jetty:9.3.6:20151106:*:*:*:*:*:*cpe:2.3:a:eclipse:jetty:9.3.7:20160115:*:*:*:*:*:*cpe:2.3:a:eclipse:jetty:9.3.7:rc0:*:*:*:*:*:*cpe:2.3:a:eclipse:jetty:9.3.7:rc1:*:*:*:*:*:*cpe:2.3:a:eclipse:jetty:9.3.8:20160311:*:*:*:*:*:*cpe:2.3:a:eclipse:jetty:9.3.8:20160314:*:*:*:*:*:*cpe:2.3:a:eclipse:jetty:9.3.8:rc0:*:*:*:*:*:*cpe:2.3:a:eclipse:jetty:9.3.9:20160517:*:*:*:*:*:*cpe:2.3:a:eclipse:jetty:9.3.9:maintenance_0:*:*:*:*:*:*cpe:2.3:a:eclipse:jetty:9.3.9:maintenance_1:*:*:*:*:*:*cpe:2.3:a:eclipse:jetty:9.3.10:20160621:*:*:*:*:*:*cpe:2.3:a:eclipse:jetty:9.3.10:maintenance_0:*:*:*:*:*:*cpe:2.3:a:eclipse:jetty:9.3.11:20160721:*:*:*:*:*:*cpe:2.3:a:eclipse:jetty:9.3.11:maintenance_0:*:*:*:*:*:*cpe:2.3:a:eclipse:jetty:9.3.12:20160915:*:*:*:*:*:*cpe:2.3:a:eclipse:jetty:9.3.13:20161014:*:*:*:*:*:*cpe:2.3:a:eclipse:jetty:9.3.13:maintenance_0:*:*:*:*:*:*cpe:2.3:a:eclipse:jetty:9.3.14:20161028:*:*:*:*:*:*cpe:2.3:a:eclipse:jetty:9.3.15:20161220:*:*:*:*:*:*cpe:2.3:a:eclipse:jetty:9.3.16:20170119:*:*:*:*:*:*cpe:2.3:a:eclipse:jetty:9.3.16:20170120:*:*:*:*:*:*cpe:2.3:a:eclipse:jetty:9.3.17:20170317:*:*:*:*:*:*cpe:2.3:a:eclipse:jetty:9.3.17:rc0:*:*:*:*:*:*- +45 more
Affected products
| Product | Versions |
|---|---|
| The Eclipse Foundation · Eclipse Jetty | affected 9.3.0 < unspecified ; affected unspecified < 9.4.12 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |