Resource exhaustion in Jetty - CVE-2024-6762

Vulnerability identifier: #VU98519

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-6762

CWE-ID: CWE-400

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources within the PushSessionCacheFilter. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

Jetty
Debian Linux
openEuler
Anolis OS
IBM Process Mining
jetty-jstl
jetty-alpn-client
jetty-maven-plugin
jetty-nosql
jetty-osgi-alpn
jetty-osgi-boot
jetty-osgi-boot-jsp
jetty-osgi-boot-warurl
jetty-plus
jetty-project
jetty-proxy
jetty-quickstart
jetty-rewrite
jetty-security
jetty-server
jetty-servlet
jetty-servlets
jetty-spring
jetty-start
jetty-unixsocket
jetty-util
jetty-util-ajax
jetty-webapp
jetty-websocket-api
jetty-websocket-client
jetty-websocket-common
jetty-websocket-server
jetty-websocket-servlet
jetty-xml
jetty-jsp
jetty
jetty-alpn-server
jetty-annotations
jetty-ant
jetty-cdi
jetty-client
jetty-continuation
jetty-deploy
jetty-fcgi-client
jetty-fcgi-server
jetty-http
jetty-http-spi
jetty-http2-client
jetty-http2-common
jetty-http2-http-client-transport
jetty-jspc-maven-plugin
jetty-http2-hpack
jetty-jndi
jetty-jmx
jetty-javax-websocket-server-impl
jetty-javax-websocket-client-impl
jetty-javadoc
jetty-jaspi
jetty-jaas
jetty-io
jetty-infinispan
jetty-httpservice
jetty-http2-server
jetty9 (Debian package)

Install updates from vendor's website.

Jetty - addressed in versions 10.0.18, 11.0.18, 12.0.4
IBM Process Mining - update to 2.0
jetty-jstl - update to 9.4.16-8
jetty-alpn-client - update to 9.4.16-8
jetty-maven-plugin - update to 9.4.16-8
jetty-nosql - update to 9.4.16-8
jetty-osgi-alpn - update to 9.4.16-8
jetty-osgi-boot - update to 9.4.16-8
jetty-osgi-boot-jsp - update to 9.4.16-8
jetty-osgi-boot-warurl - update to 9.4.16-8
jetty-plus - update to 9.4.16-8
jetty-project - update to 9.4.16-8
jetty-proxy - update to 9.4.16-8
jetty-quickstart - update to 9.4.16-8
jetty-rewrite - update to 9.4.16-8
jetty-security - update to 9.4.16-8
jetty-server - update to 9.4.16-8
jetty-servlet - update to 9.4.16-8
jetty-servlets - update to 9.4.16-8
jetty-spring - update to 9.4.16-8
jetty-start - update to 9.4.16-8
jetty-unixsocket - update to 9.4.16-8
jetty-util - update to 9.4.16-8
jetty-util-ajax - update to 9.4.16-8
jetty-webapp - update to 9.4.16-8
jetty-websocket-api - update to 9.4.16-8
jetty-websocket-client - update to 9.4.16-8
jetty-websocket-common - update to 9.4.16-8
jetty-websocket-server - update to 9.4.16-8
jetty-websocket-servlet - update to 9.4.16-8
jetty-xml - update to 9.4.16-8
jetty-jsp - update to 9.4.16-8
jetty - update to 9.4.16-8
jetty-alpn-server - update to 9.4.16-8
jetty-annotations - update to 9.4.16-8
jetty-ant - update to 9.4.16-8
jetty-cdi - update to 9.4.16-8
jetty-client - update to 9.4.16-8
jetty-continuation - update to 9.4.16-8
jetty-deploy - update to 9.4.16-8
jetty-fcgi-client - update to 9.4.16-8
jetty-fcgi-server - update to 9.4.16-8
jetty-http - update to 9.4.16-8
jetty-http-spi - update to 9.4.16-8
jetty-http2-client - update to 9.4.16-8
jetty-http2-common - update to 9.4.16-8
jetty-http2-http-client-transport - update to 9.4.16-8
jetty-jspc-maven-plugin - update to 9.4.16-8
jetty-http2-hpack - update to 9.4.16-8
jetty-jndi - update to 9.4.16-8
jetty-jmx - update to 9.4.16-8
jetty-javax-websocket-server-impl - update to 9.4.16-8
jetty-javax-websocket-client-impl - update to 9.4.16-8
jetty-javadoc - update to 9.4.16-8
jetty-jaspi - update to 9.4.16-8
jetty-jaas - update to 9.4.16-8
jetty-io - update to 9.4.16-8
jetty-infinispan - update to 9.4.16-8
jetty-httpservice - update to 9.4.16-8
jetty-http2-server - update to 9.4.16-8
jetty-xml - update to 9.4.43-5
jetty-webapp - update to 9.4.43-5
jetty-util-ajax - update to 9.4.43-5
jetty-util - update to 9.4.43-5
jetty-servlet - update to 9.4.43-5
jetty-server - update to 9.4.43-5
jetty-security - update to 9.4.43-5
jetty-jmx - update to 9.4.43-5
jetty-javadoc - update to 9.4.43-5
jetty-jaas - update to 9.4.43-5
jetty-io - update to 9.4.43-5
jetty-http - update to 9.4.43-5
jetty-continuation - update to 9.4.43-5
jetty-client - update to 9.4.43-5
jetty - update to 9.4.43-5
jetty9 (Debian package) - update to 9.4.57-0+deb12u1

• https://github.com/jetty/jetty.project/security/advisories/GHSA-r7m4-f9h5-gr79

• Remote denial of service in Eclipse Jetty PushCacheFilter
• openEuler update for jetty
• Debian update for jetty9
• Multiple vulnerabilities in IBM Process Mining
• Anolis OS update for jetty