Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

fstec логотип

BDU:2023-05675

Опубликовано: 18 апр. 2023
Источник: fstec
CVSS3: 5.3
CVSS2: 10
EPSS Средний

Описание

Уязвимость функций HttpServletRequest.getParameter() иHttpServletRequest.getParts() контейнера сервлетов Eclipse Jetty связана с выделением неограниченной памяти. Эксплуатация уязвимости может позволить нарушителю , действующему удаленно, вызвать отказ в обслуживании

Вендор

Red Hat Inc.
Eclipse Foundation
АО "НППКТ"

Наименование ПО

Red Hat Enterprise Linux
JBoss Enterprise Application Platform
Red Hat Single Sign-On
JBoss A-MQ Streaming
Red Hat Integration Service Registry
Red Hat Integration Camel Quarkus
Red Hat JBoss Enterprise Application Platform Expansion Pack
Red Hat Satellite
OpenShift Developer Tools and Services
Red Hat Integration Camel for Spring Boot
Migration Toolkit for Applications
OpenShift Serverless
Migration Toolkit for Runtimes
Jetty
ОСОН ОСнова Оnyx

Версия ПО

8 (Red Hat Enterprise Linux)
7 (JBoss Enterprise Application Platform)
7 (Red Hat Single Sign-On)
- (JBoss A-MQ Streaming)
- (Red Hat Integration Service Registry)
- (Red Hat Integration Camel Quarkus)
- (Red Hat JBoss Enterprise Application Platform Expansion Pack)
6 (Red Hat Satellite)
9 (Red Hat Enterprise Linux)
- (OpenShift Developer Tools and Services)
- (Red Hat Integration Camel for Spring Boot)
6 (Migration Toolkit for Applications)
- (OpenShift Serverless)
- (Migration Toolkit for Runtimes)
от 11.0.0 до 11.0.14 (Jetty)
от 10.0.0 до 10.0.14 (Jetty)
до 9.4.51 (Jetty)
до 2.9 (ОСОН ОСнова Оnyx)

Тип ПО

Операционная система
Прикладное ПО информационных систем
Сетевое программное средство
Сетевое средство

Операционные системы и аппаратные платформы

Red Hat Inc. Red Hat Enterprise Linux 8
Red Hat Inc. Red Hat Enterprise Linux 9
АО "НППКТ" ОСОН ОСнова Оnyx до 2.9

Уровень опасности уязвимости

Критический уровень опасности (базовая оценка CVSS 2.0 составляет 10)
Средний уровень опасности (базовая оценка CVSS 3.0 составляет 5,3)

Возможные меры по устранению уязвимости

Использование рекомендаций:
Для Eclipse Jetty:
https://github.com/eclipse/jetty.project/pull/9345
https://github.com/eclipse/jetty.project/pull/9344
https://github.com/eclipse/jetty.project/security/advisories/GHSA-qw69-rqj8-6qw8
https://github.com/eclipse/jetty.project/issues/9076
Для программных продуктов Red Hat Inc.:
https://access.redhat.com/security/cve/cve-2023-26048
Для ОСОН ОСнова Оnyx:
Обновление программного обеспечения jetty9 до версии 9.4.50+repack-4+deb11u1.osnova1

Статус уязвимости

Подтверждена производителем

Наличие эксплойта

Данные уточняются

Информация об устранении

Уязвимость устранена

Идентификаторы других систем описаний уязвимостей

EPSS

Процентиль: 97%
0.4117
Средний

5.3 Medium

CVSS3

10 Critical

CVSS2

Связанные уязвимости

CVSS3: 5.3
redos
11 месяцев назад

Множественные уязвимости jetty

CVSS3: 5.3
ubuntu
около 2 лет назад

Jetty is a java based web server and servlet engine. In affected versions servlets with multipart support (e.g. annotated with `@MultipartConfig`) that call `HttpServletRequest.getParameter()` or `HttpServletRequest.getParts()` may cause `OutOfMemoryError` when the client sends a multipart request with a part that has a name but no filename and very large content. This happens even with the default settings of `fileSizeThreshold=0` which should stream the whole part content to disk. An attacker client may send a large multipart request and cause the server to throw `OutOfMemoryError`. However, the server may be able to recover after the `OutOfMemoryError` and continue its service -- although it may take some time. This issue has been patched in versions 9.4.51, 10.0.14, and 11.0.14. Users are advised to upgrade. Users unable to upgrade may set the multipart parameter `maxRequestSize` which must be set to a non-negative value, so the whole multipart content is limited (although still...

CVSS3: 5.3
redhat
около 2 лет назад

Jetty is a java based web server and servlet engine. In affected versions servlets with multipart support (e.g. annotated with `@MultipartConfig`) that call `HttpServletRequest.getParameter()` or `HttpServletRequest.getParts()` may cause `OutOfMemoryError` when the client sends a multipart request with a part that has a name but no filename and very large content. This happens even with the default settings of `fileSizeThreshold=0` which should stream the whole part content to disk. An attacker client may send a large multipart request and cause the server to throw `OutOfMemoryError`. However, the server may be able to recover after the `OutOfMemoryError` and continue its service -- although it may take some time. This issue has been patched in versions 9.4.51, 10.0.14, and 11.0.14. Users are advised to upgrade. Users unable to upgrade may set the multipart parameter `maxRequestSize` which must be set to a non-negative value, so the whole multipart content is limited (although still...

CVSS3: 5.3
nvd
около 2 лет назад

Jetty is a java based web server and servlet engine. In affected versions servlets with multipart support (e.g. annotated with `@MultipartConfig`) that call `HttpServletRequest.getParameter()` or `HttpServletRequest.getParts()` may cause `OutOfMemoryError` when the client sends a multipart request with a part that has a name but no filename and very large content. This happens even with the default settings of `fileSizeThreshold=0` which should stream the whole part content to disk. An attacker client may send a large multipart request and cause the server to throw `OutOfMemoryError`. However, the server may be able to recover after the `OutOfMemoryError` and continue its service -- although it may take some time. This issue has been patched in versions 9.4.51, 10.0.14, and 11.0.14. Users are advised to upgrade. Users unable to upgrade may set the multipart parameter `maxRequestSize` which must be set to a non-negative value, so the whole multipart content is limited (although still re

CVSS3: 5.3
debian
около 2 лет назад

Jetty is a java based web server and servlet engine. In affected versi ...

EPSS

Процентиль: 97%
0.4117
Средний

5.3 Medium

CVSS3

10 Critical

CVSS2