Resource exhaustion in Eclipse Jetty
CVE-2018-12545
In Eclipse Jetty version 9.3.x and 9.4.x, the server is vulnerable to Denial of Service conditions if a remote client sends either large SETTINGs frames container containing many settings, or many small SETTINGs frames. The vulnerability is due to the additional CPU and memory allocations required to handle changed settings.
Vulnerability class: DoS (Denial of Service)
EPSS: 0.051 (91.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
Affected products
- Eclipse Jetty — versions 9.3.0, 9.3.1, 9.3.2
- The Eclipse Foundation Jetty — versions unspecified, 9.3.0
- Fedoraproject Fedora — versions 28
Weakness classification (CWE)
Public proof-of-concept exploits
References
- emo@eclipse.org (mailing-list, x_refsource_MLIST)
- emo@eclipse.org (mailing-list, x_refsource_MLIST)
- emo@eclipse.org (mailing-list, x_refsource_MLIST)
- emo@eclipse.org (mailing-list, x_refsource_MLIST)
- emo@eclipse.org (vendor-advisory, x_refsource_FEDORA)
- emo@eclipse.org (mailing-list, x_refsource_MLIST)
- emo@eclipse.org (Patch, Third Party Advisory, x_refsource_MISC)
- emo@eclipse.org (Third Party Advisory, x_refsource_MISC)
- emo@eclipse.org (x_refsource_CONFIRM, Issue Tracking, Vendor Advisory)
Frequently asked questions
- What is CVE-2018-12545?
- CVE-2018-12545 is a high-severity vulnerability in Eclipse Jetty, classified under Uncontrolled Resource Consumption. CVSS score: 7.5/10. Published 2019-03-27.
- How severe is CVE-2018-12545?
- High severity. CVSS v3 base score is 7.5 out of 10.
- Is CVE-2018-12545 known to be exploited?
- 3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.