Описание
In Eclipse Jetty version 9.3.x and 9.4.x, the server is vulnerable to Denial of Service conditions if a remote client sends either large SETTINGs frames container containing many settings, or many small SETTINGs frames. The vulnerability is due to the additional CPU and memory allocations required to handle changed settings.
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| jetty9 | not-affected | package |
Примечания
https://bugs.eclipse.org/bugs/show_bug.cgi?id=538096
Issue is not present in 9.2.x as there is no HTTP/2 support. Fixed upstream
in 9.4.12. Debian package moved directly to 9.4.14-1 containing the fix and
thus never including in unstable a vulnerable version.
Cf. https://bugs.eclipse.org/bugs/show_bug.cgi?id=538096#c7
Связанные уязвимости
In Eclipse Jetty version 9.3.x and 9.4.x, the server is vulnerable to Denial of Service conditions if a remote client sends either large SETTINGs frames container containing many settings, or many small SETTINGs frames. The vulnerability is due to the additional CPU and memory allocations required to handle changed settings.
In Eclipse Jetty version 9.3.x and 9.4.x, the server is vulnerable to Denial of Service conditions if a remote client sends either large SETTINGs frames container containing many settings, or many small SETTINGs frames. The vulnerability is due to the additional CPU and memory allocations required to handle changed settings.
In Eclipse Jetty version 9.3.x and 9.4.x, the server is vulnerable to Denial of Service conditions if a remote client sends either large SETTINGs frames container containing many settings, or many small SETTINGs frames. The vulnerability is due to the additional CPU and memory allocations required to handle changed settings.
Uncontrolled Resource Consumption in org.eclipse.jetty:jetty-server
Уязвимость HTTP-сервера Jetty, связанная с неконтролируемым расходом ресурса, позволяющая нарушителю вызвать отказ в обслуживании