7.5

CVE-2018-12545

In Eclipse Jetty version 9.3.x and 9.4.x, the server is vulnerable to Denial of Service conditions if a remote client sends either large SETTINGs frames container containing many settings, or many small SETTINGs frames. The vulnerability is due to the additional CPU and memory allocations required to handle changed settings.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Eclipse ≫ Jetty Version 9.3.0 Update 20150601
Eclipse ≫ Jetty Version 9.3.0 Update 20150608
Eclipse ≫ Jetty Version 9.3.0 Update 20150612
Eclipse ≫ Jetty Version 9.3.0 Update maintenance0
Eclipse ≫ Jetty Version 9.3.0 Update maintenance1
Eclipse ≫ Jetty Version 9.3.0 Update maintenance2
Eclipse ≫ Jetty Version 9.3.0 Update rc0
Eclipse ≫ Jetty Version 9.3.0 Update rc1
Eclipse ≫ Jetty Version 9.3.1 Update 20150714
Eclipse ≫ Jetty Version 9.3.2 Update 20150730
Eclipse ≫ Jetty Version 9.3.3 Update 20150825
Eclipse ≫ Jetty Version 9.3.3 Update 20150827
Eclipse ≫ Jetty Version 9.3.4 Update 20151005
Eclipse ≫ Jetty Version 9.3.4 Update 20151007
Eclipse ≫ Jetty Version 9.3.4 Update rc0
Eclipse ≫ Jetty Version 9.3.4 Update rc1
Eclipse ≫ Jetty Version 9.3.5 Update 20151012
Eclipse ≫ Jetty Version 9.3.6 Update 20151106
Eclipse ≫ Jetty Version 9.3.7 Update 20160115
Eclipse ≫ Jetty Version 9.3.7 Update rc0
Eclipse ≫ Jetty Version 9.3.7 Update rc1
Eclipse ≫ Jetty Version 9.3.8 Update 20160311
Eclipse ≫ Jetty Version 9.3.8 Update 20160314
Eclipse ≫ Jetty Version 9.3.8 Update rc0
Eclipse ≫ Jetty Version 9.3.9 Update 20160517
Eclipse ≫ Jetty Version 9.3.9 Update maintenance_0
Eclipse ≫ Jetty Version 9.3.9 Update maintenance_1
Eclipse ≫ Jetty Version 9.3.10 Update 20160621
Eclipse ≫ Jetty Version 9.3.10 Update maintenance_0
Eclipse ≫ Jetty Version 9.3.11 Update 20160721
Eclipse ≫ Jetty Version 9.3.11 Update maintenance_0
Eclipse ≫ Jetty Version 9.3.12 Update 20160915
Eclipse ≫ Jetty Version 9.3.13 Update 20161014
Eclipse ≫ Jetty Version 9.3.13 Update maintenance_0
Eclipse ≫ Jetty Version 9.3.14 Update 20161028
Eclipse ≫ Jetty Version 9.3.15 Update 20161220
Eclipse ≫ Jetty Version 9.3.16 Update 20170119
Eclipse ≫ Jetty Version 9.3.16 Update 20170120
Eclipse ≫ Jetty Version 9.3.17 Update 20170317
Eclipse ≫ Jetty Version 9.3.17 Update rc0
Eclipse ≫ Jetty Version 9.3.18 Update 20170406
Eclipse ≫ Jetty Version 9.3.19 Update 20170502
Eclipse ≫ Jetty Version 9.3.20 Update 20170531
Eclipse ≫ Jetty Version 9.3.21 Update 20170918
Eclipse ≫ Jetty Version 9.3.21 Update maintenance_0
Eclipse ≫ Jetty Version 9.3.21 Update rc0
Eclipse ≫ Jetty Version 9.3.22 Update 20171030
Eclipse ≫ Jetty Version 9.3.23 Update 20180228
Eclipse ≫ Jetty Version 9.3.24 Update 20180605
Eclipse ≫ Jetty Version 9.4.0 Update 20161207
Eclipse ≫ Jetty Version 9.4.0 Update 20161208
Eclipse ≫ Jetty Version 9.4.0 Update 20180619
Eclipse ≫ Jetty Version 9.4.0 Update maintenance_0
Eclipse ≫ Jetty Version 9.4.0 Update maintenance_1
Eclipse ≫ Jetty Version 9.4.0 Update rc0
Eclipse ≫ Jetty Version 9.4.0 Update rc1
Eclipse ≫ Jetty Version 9.4.0 Update rc2
Eclipse ≫ Jetty Version 9.4.0 Update rc3
Eclipse ≫ Jetty Version 9.4.1 Update 20170120
Eclipse ≫ Jetty Version 9.4.1 Update 20180619
Eclipse ≫ Jetty Version 9.4.2 Update 20170220
Eclipse ≫ Jetty Version 9.4.2 Update 20180619
Eclipse ≫ Jetty Version 9.4.3 Update 20170317
Eclipse ≫ Jetty Version 9.4.3 Update 20180619
Eclipse ≫ Jetty Version 9.4.4 Update 20170410
Eclipse ≫ Jetty Version 9.4.4 Update 20170414
Eclipse ≫ Jetty Version 9.4.4 Update 20180619
Eclipse ≫ Jetty Version 9.4.5 Update 20170502
Eclipse ≫ Jetty Version 9.4.5 Update 20180619
Eclipse ≫ Jetty Version 9.4.6 Update 20170531
Eclipse ≫ Jetty Version 9.4.6 Update 20180619
Eclipse ≫ Jetty Version 9.4.7 Update 20170914
Eclipse ≫ Jetty Version 9.4.7 Update 20180619
Eclipse ≫ Jetty Version 9.4.7 Update rc0
Eclipse ≫ Jetty Version 9.4.8 Update 20171121
Eclipse ≫ Jetty Version 9.4.8 Update 20180619
Eclipse ≫ Jetty Version 9.4.9 Update 20180320
Eclipse ≫ Jetty Version 9.4.10 Update 20180503
Eclipse ≫ Jetty Version 9.4.10 Update rc0
Eclipse ≫ Jetty Version 9.4.10 Update rc1
Eclipse ≫ Jetty Version 9.4.11 Update 20180605
Eclipse ≫ Jetty Version 9.4.12 Update rc0
Eclipse ≫ Jetty Version 9.4.12 Update rc1
Eclipse ≫ Jetty Version 9.4.12 Update rc2
Fedoraproject ≫ Fedora Version 28
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 5.08% 0.912
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NIST 5 10 2.9
AV:N/AC:L/Au:N/C:N/I:N/A:P
CWE-400 Uncontrolled Resource Consumption

The product does not properly control the allocation and maintenance of a limited resource.

CWE-770 Allocation of Resources Without Limits or Throttling

The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8%40%3Ccommits.pulsar.apache.org%3E
https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe%40%3Ccommits.druid.apache.org%3E
https://www.oracle.com/security-alerts/cpuoct2020.html
Third Party Advisory
https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
Patch
Third Party Advisory
https://bugs.eclipse.org/bugs/show_bug.cgi?id=538096
Vendor Advisory
Issue Tracking
https://lists.apache.org/thread.html/13f5241048ec0bf966a6ddd306feaf40de5b20e1f09096b9cddeddf2%40%3Ccommits.accumulo.apache.org%3E
https://lists.apache.org/thread.html/70744fe4faba8e2fa7e50a7fc794dd03cb28dad8b21e08ee59bb1606%40%3Cdevnull.infra.apache.org%3E
https://lists.apache.org/thread.html/febc94ffec9275dcda64633e0276a1400cd318e571009e4cda9b7a79%40%3Cnotifications.accumulo.apache.org%3E
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CIS4LALKZNLF5X5IGNGRSKERG7FY4QG6/