Lucene search

EclipseCVE-2018-12545

HistoryMar 27, 2019 - 8:29 p.m.

CVE-2018-12545

2019-03-2720:29:03

CWE-770

CWE-400

eclipse

web.nvd.nist.gov

eclipse jetty

cve-2018-12545

denial of service

dos

nvd

security vulnerability

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

7.3

Confidence

High

EPSS

0.041

Percentile

92.3%

JSON

In Eclipse Jetty version 9.3.x and 9.4.x, the server is vulnerable to Denial of Service conditions if a remote client sends either large SETTINGs frames container containing many settings, or many small SETTINGs frames. The vulnerability is due to the additional CPU and memory allocations required to handle changed settings.

Affected configurations

Nvd

Node

eclipsejettyMatch9.3.020150601

eclipsejettyMatch9.3.020150608

eclipsejettyMatch9.3.020150612

eclipsejettyMatch9.3.0maintenance0

eclipsejettyMatch9.3.0maintenance1

eclipsejettyMatch9.3.0maintenance2

eclipsejettyMatch9.3.0rc0

eclipsejettyMatch9.3.0rc1

eclipsejettyMatch9.3.120150714

eclipsejettyMatch9.3.220150730

eclipsejettyMatch9.3.320150825

eclipsejettyMatch9.3.320150827

eclipsejettyMatch9.3.420151005

eclipsejettyMatch9.3.420151007

eclipsejettyMatch9.3.4rc0

eclipsejettyMatch9.3.4rc1

eclipsejettyMatch9.3.520151012

eclipsejettyMatch9.3.620151106

eclipsejettyMatch9.3.720160115

eclipsejettyMatch9.3.7rc0

eclipsejettyMatch9.3.7rc1

eclipsejettyMatch9.3.820160311

eclipsejettyMatch9.3.820160314

eclipsejettyMatch9.3.8rc0

eclipsejettyMatch9.3.920160517

eclipsejettyMatch9.3.9maintenance_0

eclipsejettyMatch9.3.9maintenance_1

eclipsejettyMatch9.3.1020160621

eclipsejettyMatch9.3.10maintenance_0

eclipsejettyMatch9.3.1120160721

eclipsejettyMatch9.3.11maintenance_0

eclipsejettyMatch9.3.1220160915

eclipsejettyMatch9.3.1320161014

eclipsejettyMatch9.3.13maintenance_0

eclipsejettyMatch9.3.1420161028

eclipsejettyMatch9.3.1520161220

eclipsejettyMatch9.3.1620170119

eclipsejettyMatch9.3.1620170120

eclipsejettyMatch9.3.1720170317

eclipsejettyMatch9.3.17rc0

eclipsejettyMatch9.3.1820170406

eclipsejettyMatch9.3.1920170502

eclipsejettyMatch9.3.2020170531

eclipsejettyMatch9.3.2120170918

eclipsejettyMatch9.3.21maintenance_0

eclipsejettyMatch9.3.21rc0

eclipsejettyMatch9.3.2220171030

eclipsejettyMatch9.3.2320180228

eclipsejettyMatch9.3.2420180605

eclipsejettyMatch9.4.020161207

eclipsejettyMatch9.4.020161208

eclipsejettyMatch9.4.020180619

eclipsejettyMatch9.4.0maintenance_0

eclipsejettyMatch9.4.0maintenance_1

eclipsejettyMatch9.4.0rc0

eclipsejettyMatch9.4.0rc1

eclipsejettyMatch9.4.0rc2

eclipsejettyMatch9.4.0rc3

eclipsejettyMatch9.4.120170120

eclipsejettyMatch9.4.120180619

eclipsejettyMatch9.4.220170220

eclipsejettyMatch9.4.220180619

eclipsejettyMatch9.4.320170317

eclipsejettyMatch9.4.320180619

eclipsejettyMatch9.4.420170410

eclipsejettyMatch9.4.420170414

eclipsejettyMatch9.4.420180619

eclipsejettyMatch9.4.520170502

eclipsejettyMatch9.4.520180619

eclipsejettyMatch9.4.620170531

eclipsejettyMatch9.4.620180619

eclipsejettyMatch9.4.720170914

eclipsejettyMatch9.4.720180619

eclipsejettyMatch9.4.7rc0

eclipsejettyMatch9.4.820171121

eclipsejettyMatch9.4.820180619

eclipsejettyMatch9.4.920180320

eclipsejettyMatch9.4.1020180503

eclipsejettyMatch9.4.10rc0

eclipsejettyMatch9.4.10rc1

eclipsejettyMatch9.4.1120180605

eclipsejettyMatch9.4.12rc0

eclipsejettyMatch9.4.12rc1

eclipsejettyMatch9.4.12rc2

Node

fedoraprojectfedoraMatch28

VendorProductVersionCPE
eclipsejetty9.3.0cpe:2.3:a:eclipse:jetty:9.3.0:20150601:*:*:*:*:*:*
eclipsejetty9.3.0cpe:2.3:a:eclipse:jetty:9.3.0:20150608:*:*:*:*:*:*
eclipsejetty9.3.0cpe:2.3:a:eclipse:jetty:9.3.0:20150612:*:*:*:*:*:*
eclipsejetty9.3.0cpe:2.3:a:eclipse:jetty:9.3.0:maintenance0:*:*:*:*:*:*
eclipsejetty9.3.0cpe:2.3:a:eclipse:jetty:9.3.0:maintenance1:*:*:*:*:*:*
eclipsejetty9.3.0cpe:2.3:a:eclipse:jetty:9.3.0:maintenance2:*:*:*:*:*:*
eclipsejetty9.3.0cpe:2.3:a:eclipse:jetty:9.3.0:rc0:*:*:*:*:*:*
eclipsejetty9.3.0cpe:2.3:a:eclipse:jetty:9.3.0:rc1:*:*:*:*:*:*
eclipsejetty9.3.1cpe:2.3:a:eclipse:jetty:9.3.1:20150714:*:*:*:*:*:*
eclipsejetty9.3.2cpe:2.3:a:eclipse:jetty:9.3.2:20150730:*:*:*:*:*:*

Vendor	Product	Version	CPE
eclipse	jetty	9.3.0	cpe:2.3:a:eclipse:jetty:9.3.0:20150601::::::
eclipse	jetty	9.3.0	cpe:2.3:a:eclipse:jetty:9.3.0:20150608::::::
eclipse	jetty	9.3.0	cpe:2.3:a:eclipse:jetty:9.3.0:20150612::::::
eclipse	jetty	9.3.0	cpe:2.3:a:eclipse:jetty:9.3.0:maintenance0::::::
eclipse	jetty	9.3.0	cpe:2.3:a:eclipse:jetty:9.3.0:maintenance1::::::
eclipse	jetty	9.3.0	cpe:2.3:a:eclipse:jetty:9.3.0:maintenance2::::::
eclipse	jetty	9.3.0	cpe:2.3:a:eclipse:jetty:9.3.0:rc0::::::
eclipse	jetty	9.3.0	cpe:2.3:a:eclipse:jetty:9.3.0:rc1::::::
eclipse	jetty	9.3.1	cpe:2.3:a:eclipse:jetty:9.3.1:20150714::::::
eclipse	jetty	9.3.2	cpe:2.3:a:eclipse:jetty:9.3.2:20150730::::::

Rows per page:

1-10 of 851

CNA Affected

[
  {
    "product": "Eclipse Jetty",
    "vendor": "The Eclipse Foundation",
    "versions": [
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "9.3.0",
        "versionType": "custom"
      },
      {
        "lessThan": "9.4.12",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]