Bug 2243123 (CVE-2023-36478) - CVE-2023-36478 jetty: hpack header values cause denial of service in http/2
Summary: CVE-2023-36478 jetty: hpack header values cause denial of service in http/2
Keywords:
Status: NEW
Alias: CVE-2023-36478
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Sayan Biswas
QA Contact:
URL:
Whiteboard:
Depends On: 2245807 2245808 2246123
Blocks: 2243124
TreeView+ depends on / blocked
 
Reported: 2023-10-10 21:00 UTC by Anten Skrabec
Modified: 2024-05-23 22:45 UTC (History)
25 users (show)

Fixed In Version: http2-hpack 10.0.16, http2-hpack 11.0.16, http2-hpack 9.4.53, http3-qpack 10.0.16, http3-qpack 11.0.161
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in Jetty http2-hpack and http3-qpack. If header values exceed the size limit and Huffman is the true`MetaDataBuilder.checkSize`, the multiplication will overflow, and the length will become negative, causing a large buffer allocation on the server, leading to a Denial of Service (DoS) attack.
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2023:7247 0 None None None 2023-11-15 17:08:11 UTC
Red Hat Product Errata RHSA-2024:3354 0 None None None 2024-05-23 22:45:48 UTC

Description Anten Skrabec 2023-10-10 21:00:33 UTC
Eclipse Jetty provides a web server and servlet container. In versions 11.0.0 through 11.0.15, 10.0.0 through 10.0.15, and 9.0.0 through 9.4.52, an integer overflow in `MetaDataBuilder.checkSize` allows for HTTP/2 HPACK header values to
exceed their size limit. `MetaDataBuilder.java` determines if a header name or value exceeds the size limit, and throws an exception if the limit is exceeded. However, when length is very large and huffman is true, the multiplication by 4 in line 295
will overflow, and length will become negative. `(_size+length)` will now be negative, and the check on line 296 will not be triggered. Furthermore, `MetaDataBuilder.checkSize` allows for user-entered HPACK header value sizes to be negative, potentially leading to a very large buffer allocation later on when the user-entered size is multiplied by 2. This means that if a user provides a negative length value (or, more precisely, a length value which, when multiplied by the 4/3 fudge factor, is negative), and this length value is a very large positive number when multiplied by 2, then the user can cause a very large buffer to be allocated on the server. Users of HTTP/2 can be impacted by a remote denial of service attack. The issue has been fixed in versions 11.0.16, 10.0.16, and 9.4.53. There are no known workarounds.

https://github.com/eclipse/jetty.project/pull/9634
https://github.com/eclipse/jetty.project/releases/tag/jetty-11.0.16
https://github.com/eclipse/jetty.project/security/advisories/GHSA-wgh7-54f2-x98r
https://github.com/eclipse/jetty.project/releases/tag/jetty-9.4.53.v20231009
https://github.com/eclipse/jetty.project/releases/tag/jetty-10.0.16

Comment 2 ybuenos 2023-10-24 08:05:41 UTC
Created jetty tracking bugs for this issue:

Affects: fedora-all [bug 2245807]


Created rstudio tracking bugs for this issue:

Affects: fedora-all [bug 2245808]

Comment 6 errata-xmlrpc 2023-11-15 17:08:09 UTC
This issue has been addressed in the following products:

  Red Hat Fuse 7.12.1

Via RHSA-2023:7247 https://access.redhat.com/errata/RHSA-2023:7247

Comment 9 errata-xmlrpc 2024-05-23 22:45:46 UTC
This issue has been addressed in the following products:

  Red Hat Fuse 7.13.0

Via RHSA-2024:3354 https://access.redhat.com/errata/RHSA-2024:3354


Note You need to log in before you can comment on or make changes to this bug.