#VU36036 Input validation error in Jetty and Fedora - CVE-2018-12545

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU36036

#VU36036 Input validation error in Jetty and Fedora - CVE-2018-12545

Published: March 27, 2019 / Updated: August 8, 2020


Vulnerability identifier: #VU36036
Vulnerability risk: Medium
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2018-12545
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability: No public exploit available
Vulnerable software:
Jetty
Fedora
Software vendor:
Eclipse
Fedoraproject

Description

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

In Eclipse Jetty version 9.3.x and 9.4.x, the server is vulnerable to Denial of Service conditions if a remote client sends either large SETTINGs frames container containing many settings, or many small SETTINGs frames. The vulnerability is due to the additional CPU and memory allocations required to handle changed settings.


Remediation

Install update from vendor's website.

External links