Bug 1696062 (CVE-2018-12545)
Summary: | CVE-2018-12545 jetty: large settings frames causing denial of service | ||
---|---|---|---|
Product: | [Other] Security Response | Reporter: | Dhananjay Arunesh <darunesh> |
Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
Status: | CLOSED ERRATA | QA Contact: | |
Severity: | medium | Docs Contact: | |
Priority: | medium | ||
Version: | unspecified | CC: | bkearney, chazlett, decathorpe, eclipse-sig, hhorak, java-maint, java-sig-commits, jjohnstn, jorton, krzysztof.daniel, mizdebsk, security-response-team, sochotni, stewardship-sig, tlestach, vondruch |
Target Milestone: | --- | Keywords: | Security |
Target Release: | --- | ||
Hardware: | All | ||
OS: | Linux | ||
Whiteboard: | |||
Fixed In Version: | jetty 9.4.12 | Doc Type: | If docs needed, set a value |
Doc Text: | Story Points: | --- | |
Clone Of: | Environment: | ||
Last Closed: | 2021-10-25 09:52:05 UTC | Type: | --- |
Regression: | --- | Mount Type: | --- |
Documentation: | --- | CRM: | |
Verified Versions: | Category: | --- | |
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
Cloudforms Team: | --- | Target Upstream Version: | |
Embargoed: | |||
Bug Depends On: | 1696088, 1744375, 1744376 | ||
Bug Blocks: | 1696063 |
Description
Dhananjay Arunesh
2019-04-04 05:57:40 UTC
Created jetty tracking bugs for this issue: Affects: fedora-all [bug 1696088] Can you provide reproducer and/or reference to upstream fix? I've checked upstream Bugzilla, Github issue tracker and git commit logs, but I can't find anything that relates to this vulnerability. In reply to comment #2: > Can you provide reproducer and/or reference to upstream fix? I've checked > upstream Bugzilla, Github issue tracker and git commit logs, but I can't > find anything that relates to this vulnerability. https://github.com/eclipse/jetty.project/issues/2722 https://github.com/eclipse/jetty.project/commit/9eca404da296f48f7f97eff44e7d1213415bf542 Hope this helps. There is no reproducer available at this moment Thanks, that is enough information for me to fix the issue. Statement: This issue affects the versions of jetty which is embedded in the nutch package as shipped with Red Hat Satellite 5. The jetty server is not exposed, as such exploitation is difficult, Red Hat Product Security has rated this issue as having security impact of Low in the context of Red Hat Satellite 5. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/. This vulnerability is out of security support scope for the following product: * Red Hat JBoss Fuse 6 Please refer to https://access.redhat.com/support/policy/updates/jboss_notes for more details. |