CVE-2018-12545: Uncontrolled Resource Consumption in org.eclipse.jetty:jetty-server
Summary
CVE-2018-12545: Uncontrolled Resource Consumption in org.eclipse.jetty:jetty-server. Affects org.eclipse.jetty:jetty-server across 2 version ranges.
>= 9.3.0, < 9.3.25.v20180904
>= 9.4.0, < 9.4.12.v20180830
Fixed in 9.3.25.v20180904 or 9.4.12.v20180830, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The org.eclipse.jetty:jetty-server package is a part of the Eclipse Jetty server, which is a Java-based web server and servlet container. It provides support for HTTP/2, WebSocket, and other web protocols. The package is widely used in various Java applications and frameworks for serving web content. However, versions 9.3.x and 9.4.x of the package are vulnerable to a Denial of Service (DoS) attack due to uncontrolled resource consumption when handling SETTINGs frames.
Vulnerability Detail
The vulnerability in org.eclipse.jetty:jetty-server arises when a remote client sends either large SETTINGs frames container containing many settings or many small SETTINGs frames. This can lead to a DoS condition by causing excessive CPU and memory allocations to handle the changed settings. An attacker can exploit this vulnerability to exhaust server resources, resulting in service disruption or unavailability. The vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 9.3.0, < 9.3.25.v201809049.3.25.v20180904 -
>= 9.4.0, < 9.4.12.v201808309.4.12.v20180830
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, network administrators can implement rate limiting or request filtering mechanisms to restrict the number and size of SETTINGs frames received by the server. This can help mitigate the impact of the vulnerability until the package is updated to a fixed version.
Conclusion
The org.eclipse.jetty:jetty-server package is vulnerable to a DoS attack due to uncontrolled resource consumption when handling SETTINGs frames. Upgrading to the fixed versions of the package or implementing temporary workarounds can mitigate the risk. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.eclipse.jetty:jetty-server →
FAQ
The vulnerability can be exploited by an attacker to cause a DoS condition, leading to service disruption or unavailability.
Versions 9.3.x and 9.4.x of the package are affected.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
Yes, implementing rate limiting or request filtering mechanisms can help mitigate the impact of the vulnerability until the package is updated.
To fix this vulnerability, it is recommended to upgrade to a fixed version of the org.eclipse.jetty:jetty-server package.
Related vulnerabilities
Recent vulnerabilities recorded for org.eclipse.jetty:jetty-server.
