Input validation error in Jetty and Fedora - CVE-2018-12545

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU36036

Input validation error in Jetty and Fedora - CVE-2018-12545

Published: March 27, 2019 / Updated: August 8, 2020


Vulnerability identifier: #VU36036
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-12545
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

In Eclipse Jetty version 9.3.x and 9.4.x, the server is vulnerable to Denial of Service conditions if a remote client sends either large SETTINGs frames container containing many settings, or many small SETTINGs frames. The vulnerability is due to the additional CPU and memory allocations required to handle changed settings.


Affected software

Jetty
Fedora
IBM Process Mining
IBM Spectrum Protect Storage Agent
Engineering Lifecycle Management - Jazz Foundation
jetty
IBM Cognos Command Center
IBM Cognos Analytics

How to mitigate CVE-2018-12545

Install update from vendor's website.

IBM Process Mining - update to 1.12.0.4
Engineering Lifecycle Management - Jazz Foundation - addressed in versions 7.0.3 iFix018, 7.1.0 iFix005
IBM Spectrum Protect Storage Agent - update to 8.1.19
jetty - update to 9.4.11-3.v20180605.fc28
IBM Cognos Command Center - update to 10.2.4 Fix Pack 1 IF17
IBM Cognos Analytics - addressed in versions 11.2.4 FP4, 12.0.4

External References

Related Security Bulletins