Cryptographic issues in Jetty - CVE-2011-4461
Published: June 26, 2024
Vulnerability identifier: #VU93357
CSH Severity: Low
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2011-4461
CWE-ID: CWE-310
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to Jetty computes hash values for form parameters without restricting the ability to trigger hash collisions predictably. A remote attacker can cause a denial of service (CPU consumption) by sending many crafted parameters.
Affected software
Jetty
Dell Support Assist Enterprise
IBM Qradar SIEM
Dell Support Assist Enterprise
IBM Qradar SIEM
How to mitigate CVE-2011-4461
Install updates from vendor's website.
Dell Support Assist Enterprise - update to 4.00.06.00
IBM Qradar SIEM - update to 7.5.0 Update Pack 13
IBM Qradar SIEM - update to 7.5.0 Update Pack 13
External References
- http://archives.neohapsis.com/archives/bugtraq/2011-12/0181.html
- http://marc.info/?l=bugtraq&m=143387688830075&w=2
- http://secunia.com/advisories/47408
- http://secunia.com/advisories/48981
- http://www.kb.cert.org/vuls/id/903934
- http://www.nruns.com/_downloads/advisory28122011.pdf
- http://www.ocert.org/advisories/ocert-2011-003.html
- http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html
- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
- http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
- http://www.securitytracker.com/id?1026475
- http://www.ubuntu.com/usn/USN-1429-1
- https://exchange.xforce.ibmcloud.com/vulnerabilities/72017
- https://security.netapp.com/advisory/ntap-20190307-0004/