CVE-2018-12545
The Eclipse Foundation Eclipse Jetty
HIGH 7.5
En bref
- Source
- NVD
- EPSS
- EPSS 5.12 % · centile 92 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- eclipse
- Statut NVD
- Modified
Description
In Eclipse Jetty version 9.3.x and 9.4.x, the server is vulnerable to Denial of Service conditions if a remote client sends either large SETTINGs frames container containing many settings, or many small SETTINGs frames. The vulnerability is due to the additional CPU and memory allocations required to handle changed settings.
Faiblesses (CWE)
- CWE-400 — Consommation de ressources non maîtrisée (déni de service)
- CWE-770 — Allocation de ressources sans limite ni régulation
Références
- https://lists.apache.org/thread.html/70744fe4faba8e2fa7e50a7fc794dd03cb28dad8b21e08ee59bb1606%40%3Cdevnull.infra.apache.org%3E
- https://lists.apache.org/thread.html/febc94ffec9275dcda64633e0276a1400cd318e571009e4cda9b7a79%40%3Cnotifications.accumulo.apache.org%3E
- https://lists.apache.org/thread.html/13f5241048ec0bf966a6ddd306feaf40de5b20e1f09096b9cddeddf2%40%3Ccommits.accumulo.apache.org%3E
- https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8%40%3Ccommits.pulsar.apache.org%3E
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CIS4LALKZNLF5X5IGNGRSKERG7FY4QG6/
- https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe%40%3Ccommits.druid.apache.org%3E
- https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://bugs.eclipse.org/bugs/show_bug.cgi?id=538096
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | MEDIUM 5.0 | AV:N/AC:L/Au:N/C:N/I:N/A:P | NVD · nvd@nist.gov (Primary) |
Avis
- GHSA-h2f4-v4c4-6wx4 — Uncontrolled Resource Consumption in org.eclipse.jetty:jetty-server
Références européennes
- ENISA EUVD · EUVD-2019-0383
- GCVE · GCVE-0-2018-12545
Avis du CERT-FR
- CERTFR-2024-AVI-0923 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2023-AVI-0357 — Multiples vulnérabilités dans IBM Cognos · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:eclipse:jetty:9.3.0:20150601:*:*:*:*:*:*cpe:2.3:a:eclipse:jetty:9.3.0:20150608:*:*:*:*:*:*cpe:2.3:a:eclipse:jetty:9.3.0:20150612:*:*:*:*:*:*cpe:2.3:a:eclipse:jetty:9.3.0:maintenance0:*:*:*:*:*:*cpe:2.3:a:eclipse:jetty:9.3.0:maintenance1:*:*:*:*:*:*cpe:2.3:a:eclipse:jetty:9.3.0:maintenance2:*:*:*:*:*:*cpe:2.3:a:eclipse:jetty:9.3.0:rc0:*:*:*:*:*:*cpe:2.3:a:eclipse:jetty:9.3.0:rc1:*:*:*:*:*:*cpe:2.3:a:eclipse:jetty:9.3.1:20150714:*:*:*:*:*:*cpe:2.3:a:eclipse:jetty:9.3.2:20150730:*:*:*:*:*:*cpe:2.3:a:eclipse:jetty:9.3.3:20150825:*:*:*:*:*:*cpe:2.3:a:eclipse:jetty:9.3.3:20150827:*:*:*:*:*:*cpe:2.3:a:eclipse:jetty:9.3.4:20151005:*:*:*:*:*:*cpe:2.3:a:eclipse:jetty:9.3.4:20151007:*:*:*:*:*:*cpe:2.3:a:eclipse:jetty:9.3.4:rc0:*:*:*:*:*:*cpe:2.3:a:eclipse:jetty:9.3.4:rc1:*:*:*:*:*:*cpe:2.3:a:eclipse:jetty:9.3.5:20151012:*:*:*:*:*:*cpe:2.3:a:eclipse:jetty:9.3.6:20151106:*:*:*:*:*:*cpe:2.3:a:eclipse:jetty:9.3.7:20160115:*:*:*:*:*:*cpe:2.3:a:eclipse:jetty:9.3.7:rc0:*:*:*:*:*:*cpe:2.3:a:eclipse:jetty:9.3.7:rc1:*:*:*:*:*:*cpe:2.3:a:eclipse:jetty:9.3.8:20160311:*:*:*:*:*:*cpe:2.3:a:eclipse:jetty:9.3.8:20160314:*:*:*:*:*:*cpe:2.3:a:eclipse:jetty:9.3.8:rc0:*:*:*:*:*:*cpe:2.3:a:eclipse:jetty:9.3.9:20160517:*:*:*:*:*:*cpe:2.3:a:eclipse:jetty:9.3.9:maintenance_0:*:*:*:*:*:*cpe:2.3:a:eclipse:jetty:9.3.9:maintenance_1:*:*:*:*:*:*cpe:2.3:a:eclipse:jetty:9.3.10:20160621:*:*:*:*:*:*cpe:2.3:a:eclipse:jetty:9.3.10:maintenance_0:*:*:*:*:*:*cpe:2.3:a:eclipse:jetty:9.3.11:20160721:*:*:*:*:*:*cpe:2.3:a:eclipse:jetty:9.3.11:maintenance_0:*:*:*:*:*:*cpe:2.3:a:eclipse:jetty:9.3.12:20160915:*:*:*:*:*:*cpe:2.3:a:eclipse:jetty:9.3.13:20161014:*:*:*:*:*:*cpe:2.3:a:eclipse:jetty:9.3.13:maintenance_0:*:*:*:*:*:*cpe:2.3:a:eclipse:jetty:9.3.14:20161028:*:*:*:*:*:*cpe:2.3:a:eclipse:jetty:9.3.15:20161220:*:*:*:*:*:*cpe:2.3:a:eclipse:jetty:9.3.16:20170119:*:*:*:*:*:*cpe:2.3:a:eclipse:jetty:9.3.16:20170120:*:*:*:*:*:*cpe:2.3:a:eclipse:jetty:9.3.17:20170317:*:*:*:*:*:*cpe:2.3:a:eclipse:jetty:9.3.17:rc0:*:*:*:*:*:*- +45 autres
Produits affectés
| Produit | Versions |
|---|---|
| The Eclipse Foundation · Eclipse Jetty | affected 9.3.0 < unspecified ; affected unspecified < 9.4.12 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |