Bug 2243123 (CVE-2023-36478)

Summary:	CVE-2023-36478 jetty: hpack header values cause denial of service in http/2
Product:	[Other] Security Response	Reporter:	Anten Skrabec <askrabec>
Component:	vulnerability	Assignee:	Sayan Biswas <sabiswas>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	aileenc, asatyam, bbuckingham, bcourt, chazlett, dfreiber, diagrawa, ehelms, fmongiar, gmalinko, janstey, jburrell, jnethert, jsherril, lzap, mhulan, nmoumoul, orabin, pcreech, pdelbell, peholase, rchan, rogbas, vkumar
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	http2-hpack 10.0.16, http2-hpack 11.0.16, http2-hpack 9.4.53, http3-qpack 10.0.16, http3-qpack 11.0.161	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in Jetty http2-hpack and http3-qpack. If header values exceed the size limit and Huffman is the true`MetaDataBuilder.checkSize`, the multiplication will overflow, and the length will become negative, causing a large buffer allocation on the server, leading to a Denial of Service (DoS) attack.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2245807, 2245808, 2246123
Bug Blocks:	2243124

Description Anten Skrabec 2023-10-10 21:00:33 UTC

Eclipse Jetty provides a web server and servlet container. In versions 11.0.0 through 11.0.15, 10.0.0 through 10.0.15, and 9.0.0 through 9.4.52, an integer overflow in `MetaDataBuilder.checkSize` allows for HTTP/2 HPACK header values to
exceed their size limit. `MetaDataBuilder.java` determines if a header name or value exceeds the size limit, and throws an exception if the limit is exceeded. However, when length is very large and huffman is true, the multiplication by 4 in line 295
will overflow, and length will become negative. `(_size+length)` will now be negative, and the check on line 296 will not be triggered. Furthermore, `MetaDataBuilder.checkSize` allows for user-entered HPACK header value sizes to be negative, potentially leading to a very large buffer allocation later on when the user-entered size is multiplied by 2. This means that if a user provides a negative length value (or, more precisely, a length value which, when multiplied by the 4/3 fudge factor, is negative), and this length value is a very large positive number when multiplied by 2, then the user can cause a very large buffer to be allocated on the server. Users of HTTP/2 can be impacted by a remote denial of service attack. The issue has been fixed in versions 11.0.16, 10.0.16, and 9.4.53. There are no known workarounds.

https://github.com/eclipse/jetty.project/pull/9634
https://github.com/eclipse/jetty.project/releases/tag/jetty-11.0.16
https://github.com/eclipse/jetty.project/security/advisories/GHSA-wgh7-54f2-x98r
https://github.com/eclipse/jetty.project/releases/tag/jetty-9.4.53.v20231009
https://github.com/eclipse/jetty.project/releases/tag/jetty-10.0.16

Comment 2 ybuenos 2023-10-24 08:05:41 UTC

Created jetty tracking bugs for this issue:

Affects: fedora-all [bug 2245807]


Created rstudio tracking bugs for this issue:

Affects: fedora-all [bug 2245808]

Comment 6 errata-xmlrpc 2023-11-15 17:08:09 UTC

This issue has been addressed in the following products:

  Red Hat Fuse 7.12.1

Via RHSA-2023:7247 https://access.redhat.com/errata/RHSA-2023:7247

Comment 9 errata-xmlrpc 2024-05-23 22:45:46 UTC

This issue has been addressed in the following products:

  Red Hat Fuse 7.13.0

Via RHSA-2024:3354 https://access.redhat.com/errata/RHSA-2024:3354