CVE-2004-2381: Jetty HTTP Server Denial of Service vulnerability
Summary
CVE-2004-2381: Jetty HTTP Server Denial of Service vulnerability. Affects org.mortbay.jetty:jetty versions < 4.2.19. Fixed in 4.2.19. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jetty HTTP Server is a popular open-source web server and servlet container. It is widely used for hosting Java web applications and provides a lightweight and scalable solution for serving HTTP requests. The vulnerability identified as CVE-2004-2381 affects versions of Jetty HTTP Server prior to 4.2.19. This vulnerability allows remote attackers to cause a denial of service (DoS) by sending HTTP requests with a large Content-Length header. The excessive memory usage caused by these requests can lead to application crashes and service disruption.
Vulnerability Detail
The vulnerability arises from a flaw in the HttpRequest.java file of the Jetty HTTP Server. By sending HTTP requests with a large Content-Length header, an attacker can exploit this flaw to consume excessive memory resources on the server. As a result, the server may become unresponsive, leading to a denial of service condition. This vulnerability has a moderate severity rating and can potentially impact the availability and stability of affected Jetty HTTP Server instances.
How To Fix
Minimum fixed version
4.2.19
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version of Jetty HTTP Server is not immediately feasible, a temporary workaround can be implemented to mitigate the risk. This workaround involves implementing rate limiting or request size restrictions at the network or application layer to prevent the processing of excessively large requests. By limiting the size of incoming requests, the impact of the vulnerability can be reduced until a permanent fix is applied.
Conclusion
The CVE-2004-2381 vulnerability in Jetty HTTP Server poses a risk of denial of service attacks through the exploitation of a memory consumption issue. To mitigate this vulnerability, it is crucial to upgrade to Jetty HTTP Server version 4.2.19 or later. Implementing rate limiting or request size restrictions can serve as a temporary workaround until the upgrade is performed. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.mortbay.jetty:jetty →
FAQ
The vulnerability allows remote attackers to cause a denial of service by sending HTTP requests with a large Content-Length header. This can lead to excessive memory usage and application crashes, resulting in service disruption and unavailability.
Versions of Jetty HTTP Server prior to 4.2.19 are affected by this vulnerability.
While specific exploits for this vulnerability may exist, they have not been disclosed publicly at the time of this report. However, it is advisable to apply the recommended fixes and security patches to mitigate the risk.
Yes, implementing rate limiting or request size restrictions at the network or application layer can help mitigate the risk until a permanent fix is applied.
For more information about this vulnerability, you can refer to the GitHub advisory database entry at the following link: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/04/GHSA-p5rr-q5g6-gm42/GHSA-p5rr-q5g6-gm42.json
Related vulnerabilities
Recent vulnerabilities recorded for org.mortbay.jetty:jetty.
