~ / search / GHSA-h2f4-v4c4-6wx4

GHSA-h2f4-v4c4-6wx4

Uncontrolled Resource Consumption in org.eclipse.jetty:jetty-server

Source: GitHub Advisory Database (reviewed) High CVE-2018-12545

Packages

EcosystemPackageAffectedFixed in
Maven org.eclipse.jetty:jetty-server >= 9.4.0, < 9.4.12.v20180830 9.4.12.v20180830
Maven org.eclipse.jetty:jetty-server >= 9.3.0, < 9.3.25.v20180904 9.3.25.v20180904

Details

As written in the advisory (Markdown source, shown as plain text).

In Eclipse Jetty version 9.3.x and 9.4.x, the server is vulnerable to Denial of Service conditions if a remote client sends either large SETTINGs frames container containing many settings, or many small SETTINGs frames. The vulnerability is due to the additional CPU and memory allocations required to handle changed settings.

References

External links from the advisory. They lead to third-party sites.