Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
ibmIBM6FCB312F851B6934988595C2E7724A5C11C84D610341D83ADD1A696432243B50
HistoryNov 22, 2022 - 1:47 p.m.

Security Bulletin: Rational Performance Tester contains vulnerabilities which could affect Eclipse Jetty. Rational Performance Tester has taken steps to mitigate these vulnerabilities.

2022-11-2213:47:01
www.ibm.com
15
vulnerability
eclipse jetty
denial of service
cve-2022-2191
cve-2022-2047
cve-2022-2048
security bulletin
rational performance tester

CVSS2

5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.002

Percentile

54.9%

JSON

Summary

Eclipse Jetty contains a vulnerability around improper hostname input handling that could lead to failure in a proxy scenario, and a vulnerability that could lead to a potential denial of service attack.

Vulnerability Details

CVEID:CVE-2022-2191
**DESCRIPTION:**Eclipse Jetty is vulnerable to a denial of service, caused by a flaw with SslConnection does not release ByteBuffers from configured ByteBufferPool in case of error code paths. By sending a specially-crafted request, a remote attacker could exploit this vulnerability to cause a denial of service condition.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/230671 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

CVEID:CVE-2022-2047
**DESCRIPTION:**Eclipse Jetty could allow a remote authenticated attacker to bypass security restrictions, caused by a flaw in the HttpURI class. By sending a specially-crafted request, an attacker could exploit this vulnerability to the HttpClient and ProxyServlet/AsyncProxyServlet/AsyncMiddleManServlet wrongly interpreting an authority with no host as one with a host.
CVSS Base score: 2.7
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/230668 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N)

CVEID:CVE-2022-2048
**DESCRIPTION:**Eclipse Jetty is vulnerable to a denial of service, caused by a flaw in the error handling of an invalid HTTP/2 request. By sending specially-crafted HTTP/2 requests, a remote attacker could exploit this vulnerability to cause the server to become unresponsive, and results in a denial of service condition.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/230670 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Affected Products and Versions

Affected Product(s) Version(s)
RPT 10.1
RPT 10.0
RPT 10.2
RPT 9.2
RPT 9.5

Remediation/Fixes

Upgrading to Rational Performance Tester version 10.5 is strongly recommended.

Product VRMF APAR Remediation/First Fix
RPT 10.2 None <https://download4.boulder.ibm.com/sar/CMA/RAA/0atii/0/PSIRT58763_RPT-RST-ifix.zip&gt;
RPT 10.1 None <https://download4.boulder.ibm.com/sar/CMA/RAA/0atii/0/PSIRT58763_RPT-RST-ifix.zip&gt;
RPT 10.0 None <https://download4.boulder.ibm.com/sar/CMA/RAA/0atii/0/PSIRT58763_RPT-RST-ifix.zip&gt;
RPT 9.5 None <https://download4.boulder.ibm.com/sar/CMA/RAA/0atii/0/PSIRT58763_RPT-RST-ifix.zip&gt;
RPT 9.2 None <https://download4.boulder.ibm.com/sar/CMA/RAA/0atii/0/PSIRT58763_RPT-RST-ifix.zip&gt;

Workarounds and Mitigations

None

Affected configurations

Vulners
Node
ibmrational_performance_testerMatch9.2
OR
ibmrational_performance_testerMatch9.5
OR
ibmrational_performance_testerMatch10.0
OR
ibmrational_performance_testerMatch10.1
OR
ibmrational_performance_testerMatch10.2
VendorProductVersionCPE
ibmrational_performance_tester9.2cpe:2.3:a:ibm:rational_performance_tester:9.2:*:*:*:*:*:*:*
ibmrational_performance_tester9.5cpe:2.3:a:ibm:rational_performance_tester:9.5:*:*:*:*:*:*:*
ibmrational_performance_tester10.0cpe:2.3:a:ibm:rational_performance_tester:10.0:*:*:*:*:*:*:*
ibmrational_performance_tester10.1cpe:2.3:a:ibm:rational_performance_tester:10.1:*:*:*:*:*:*:*
ibmrational_performance_tester10.2cpe:2.3:a:ibm:rational_performance_tester:10.2:*:*:*:*:*:*:*

Related

ibm 41
openvas 8
debian 2
osv 9
nessus 9
redhat 7
ubuntucve 3
github 3
cve 3
alpinelinux 1
veracode 3
prion 3
debiancve 3
redhatcve 3
nvd 3
cvelist 3
githubexploit 1
oracle 4
ibm
ibm
Security Bulletin: Rational Service Tester contains vulnerabilities which could affect Eclipse Jetty. Rational Service Tester has taken steps to mitigate these vulnerabilities.
2022-11-22 13:50:54
Security Bulletin: An Eclipse Jetty vulnerability affects IBM Rational Functional Tester
2022-08-17 05:45:47
Security Bulletin: Tivoli Netcool/Omnibus installation contains vulnerable Eclipse Jetty code libraries (Multiple CVEs)
2022-12-30 14:56:25
openvas
openvas
Debian: Security Advisory (DLA-3079-1)
2022-08-22 00:00:00
Debian: Security Advisory (DSA-5198-1)
2022-08-03 00:00:00
Eclipse Jetty Multiple Vulnerabilities (Jul 2022) - Windows
2022-07-08 00:00:00
debian
debian
[SECURITY] [DSA 5198-1] jetty9 security update
2022-08-02 11:01:19
[SECURITY] [DLA 3079-1] jetty9 security update
2022-08-21 22:58:15
osv
osv
jetty9 - security update
2022-08-02 00:00:00
jetty9 - security update
2022-08-22 00:00:00
BIT-jenkins-2022-2048
2024-03-06 10:58:27
nessus
nessus
Debian DSA-5198-1 : jetty9 - security update
2022-08-03 00:00:00
Debian DLA-3079-1 : jetty9 - LTS security update
2022-08-22 00:00:00
Jenkins LTS < 2.361.1 / Jenkins weekly < 2.363
2022-09-09 00:00:00
redhat
redhat
(RHSA-2023:0189) Moderate: Red Hat AMQ Streams 2.3.0 release and security update
2023-01-17 11:45:43
(RHSA-2023:1661) Important: Red Hat AMQ Broker 7.11.0 release and security update
2023-04-05 13:22:07
(RHSA-2023:3663) Important: jenkins and jenkins-2-plugins security update
2023-06-19 10:09:14
ubuntucve
ubuntucve
CVE-2022-2048
2022-07-07 00:00:00
CVE-2022-2191
2022-07-07 00:00:00
CVE-2022-2047
2022-07-07 00:00:00
github
github
Jetty vulnerable to Invalid HTTP/2 requests that can lead to denial of service
2022-07-07 20:55:40
Jetty SslConnection does not release pooled ByteBuffers in case of errors
2022-07-07 20:55:37
Jetty invalid URI parsing may produce invalid HttpURI.authority
2022-07-07 20:55:34
cve
cve
CVE-2022-2048
2022-07-07 21:15:10
CVE-2022-2191
2022-07-07 21:15:10
CVE-2022-2047
2022-07-07 21:15:10
alpinelinux
alpinelinux
CVE-2022-2048
2022-07-07 21:15:10
veracode
veracode
Denial Of Service (DoS)
2022-07-08 05:05:57
Denial Of Service (DoS)
2022-07-08 07:05:36
Improper Input Validation
2022-07-08 04:29:10
prion
prion
Design/Logic Flaw
2022-07-07 21:15:00
Code injection
2022-07-07 21:15:00
Design/Logic Flaw
2022-07-07 21:15:00
debiancve
debiancve
CVE-2022-2048
2022-07-07 21:15:10
CVE-2022-2191
2022-07-07 21:15:10
CVE-2022-2047
2022-07-07 21:15:10
redhatcve
redhatcve
CVE-2022-2048
2022-08-09 15:36:51
CVE-2022-2191
2022-08-09 15:37:00
CVE-2022-2047
2022-08-09 15:36:51
nvd
nvd
CVE-2022-2048
2022-07-07 21:15:10
CVE-2022-2047
2022-07-07 21:15:10
CVE-2022-2191
2022-07-07 21:15:10
cvelist
cvelist
CVE-2022-2048
2022-07-07 20:35:09
CVE-2022-2047
2022-07-07 20:45:12
CVE-2022-2191
2022-07-07 20:45:16
githubexploit
githubexploit
Exploit for CVE-2022-2048
2023-10-31 11:32:00
oracle
oracle
Oracle Critical Patch Update Advisory - January 2023
2023-01-17 00:00:00
Oracle Critical Patch Update Advisory - October 2022
2022-10-18 00:00:00
Oracle Critical Patch Update Advisory - July 2023
2023-07-18 00:00:00

CVSS2

5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.002

Percentile

54.9%

JSON
Related for 6FCB312F851B6934988595C2E7724A5C11C84D610341D83ADD1A696432243B50
ibm41openvas8debian2osv9nessus9redhat7ubuntucve3github3cve3alpinelinux1veracode3prion3debiancve3redhatcve3nvd3cvelist3githubexploit1oracle4