Bug 1696062 (CVE-2018-12545) - CVE-2018-12545 jetty: large settings frames causing denial of service
Summary: CVE-2018-12545 jetty: large settings frames causing denial of service
Keywords:
Status: NEW
Alias: CVE-2018-12545
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1696088 1744375 1744376
Blocks: 1696063
TreeView+ depends on / blocked
 
Reported: 2019-04-04 05:57 UTC by Dhananjay Arunesh
Modified: 2019-12-11 13:53 UTC (History)
15 users (show)

Fixed In Version: jetty 9.4.12
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed:


Attachments (Terms of Use)

Description Dhananjay Arunesh 2019-04-04 05:57:40 UTC
In Eclipse Jetty version 9.3.x and 9.4.x, the server is vulnerable to Denial of Service conditions if a remote client sends either large SETTINGs frames container containing many settings, or many small SETTINGs frames. The vulnerability is due to the additional CPU and memory allocations required to handle changed settings

Reference:
https://bugs.eclipse.org/bugs/show_bug.cgi?id=538096

Comment 1 Dhananjay Arunesh 2019-04-04 06:59:07 UTC
Created jetty tracking bugs for this issue:

Affects: fedora-all [bug 1696088]

Comment 2 Mikolaj Izdebski 2019-04-04 12:47:15 UTC
Can you provide reproducer and/or reference to upstream fix? I've checked upstream Bugzilla, Github issue tracker and git commit logs, but I can't find anything that relates to this vulnerability.

Comment 3 Huzaifa S. Sidhpurwala 2019-04-11 05:13:47 UTC
In reply to comment #2:
> Can you provide reproducer and/or reference to upstream fix? I've checked
> upstream Bugzilla, Github issue tracker and git commit logs, but I can't
> find anything that relates to this vulnerability.

https://github.com/eclipse/jetty.project/issues/2722
https://github.com/eclipse/jetty.project/commit/9eca404da296f48f7f97eff44e7d1213415bf542

Hope this helps. There is no reproducer available at this moment

Comment 4 Mikolaj Izdebski 2019-04-11 13:59:43 UTC
Thanks, that is enough information for me to fix the issue.

Comment 5 Cedric Buissart 🐶 2019-05-22 15:21:41 UTC
Statement:

This issue affects the versions of jetty which is embedded in the nutch package as shipped with Red Hat Satellite 5. The jetty server is not exposed, as such exploitation is difficult, Red Hat Product Security has rated this issue as having security impact of Low in the context of Red Hat Satellite 5. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Comment 6 Joshua Padman 2019-06-12 02:55:17 UTC
This vulnerability is out of security support scope for the following product:
 * Red Hat JBoss Fuse 6

Please refer to https://access.redhat.com/support/policy/updates/jboss_notes for more details.


Note You need to log in before you can comment on or make changes to this bug.