SB2019032714 - Input validation error in Eclipse Jetty

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2019032714

SB2019032714 - Input validation error in Eclipse Jetty

Published: March 27, 2019 Updated: August 8, 2020

Security Bulletin ID SB2019032714
Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 security vulnerability.


1) Input validation error (CVE-ID: CVE-2018-12545)

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

In Eclipse Jetty version 9.3.x and 9.4.x, the server is vulnerable to Denial of Service conditions if a remote client sends either large SETTINGs frames container containing many settings, or many small SETTINGs frames. The vulnerability is due to the additional CPU and memory allocations required to handle changed settings.


Remediation

Install update from vendor's website.

References