CVE-2022-2048
First published: Thu Jul 07 2022(Updated: )
### Description Invalid HTTP/2 requests (for example, invalid URIs) are incorrectly handled by writing a blocking error response directly from the selector thread. If the client manages to exhaust the HTTP/2 flow control window, or TCP congest the connection, the selector thread will be blocked trying to write the error response. If this is repeated for all the selector threads, the server becomes unresponsive, causing the denial of service. ### Impact A malicious client may render the server unresponsive. ### Patches The fix is available in Jetty versions 9.4.47. 10.0.10, 11.0.10. ### Workarounds No workaround available within Jetty itself. One possible workaround is to filter the requests before sending them to Jetty (for example in a proxy) ### For more information If you have any questions or comments about this advisory: * Email us at security@webtide.com.
Credit: emo@eclipse.org emo@eclipse.org emo@eclipse.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| maven/org.eclipse.jetty.http2:http2-server | >=11.0.0<11.0.10 | 11.0.10 |
| maven/org.eclipse.jetty.http2:http2-server | >=10.0.0<10.0.10 | 10.0.10 |
| maven/org.eclipse.jetty.http2:http2-server | <9.4.47 | 9.4.47 |
| redhat/jenkins | <0:2.401.1.1686831596-3.el8 | 0:2.401.1.1686831596-3.el8 |
| redhat/jenkins | <0:2.361.1.1672840472-1.el8 | 0:2.361.1.1672840472-1.el8 |
| redhat/jenkins | <0:2.361.1.1675668150-1.el8 | 0:2.361.1.1675668150-1.el8 |
| Eclipse Jetty | <9.4.47 | |
| Eclipse Jetty | >=10.0.0<10.0.9 | |
| Eclipse Jetty | >=11.0.0<11.0.9 | |
| Debian Debian Linux | =10.0 | |
| Debian Debian Linux | =11.0 | |
| Netapp Element Plug-in For Vcenter Server | ||
| Netapp Management Services For Element Software And Netapp Hci | ||
| Netapp Snapcenter | ||
| Netapp Solidfire \& Hci Storage Node | ||
| Netapp Hci Compute Node | ||
| Jenkins Jenkins | <2.263 | |
| Jenkins Jenkins | <2.361.1 | |
| debian/jetty9 | <=9.4.16-0+deb10u1 | 9.4.50-4+deb10u1 9.4.39-3+deb11u2 9.4.50-4+deb11u1 9.4.50-4+deb12u1 9.4.50-4+deb12u2 9.4.53-1 |
| redhat/http2-server | <9.4.47 | 9.4.47 |
| redhat/http2-server | <10.0.10 | 10.0.10 |
| redhat/http2-server | <11.0.10 | 11.0.10 |
| IBM Cloud Pak for Business Automation | <=V22.0.2 | |
| IBM Cloud Pak for Business Automation | <=V21.0.3 - V21.0.3-IF016 | |
| IBM Cloud Pak for Business Automation | <=V22.0.1 - V22.0.1-IF006 and later fixes V21.0.2 - V21.0.2-IF012 and later fixesV21.0.1 - V21.0.1-IF007 and later fixesV20.0.1 - V20.0.3 and later fixesV19.0.1 - V19.0.3 and later fixesV18.0.0 - V18.0.2 and later fixes |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/eclipse/jetty.project/security/advisories/GHSA-wgmr-mf83-7x4j
- https://nvd.nist.gov/vuln/detail/CVE-2022-2048
- https://www.debian.org/security/2022/dsa-5198
- https://lists.debian.org/debian-lts-announce/2022/08/msg00011.html
- https://security.netapp.com/advisory/ntap-20220901-0006/
- http://www.openwall.com/lists/oss-security/2022/09/09/2
- https://github.com/advisories/GHSA-wgmr-mf83-7x4j (Advisory)
- https://www.cve.org/CVERecord?id=CVE-2022-2048 https://nvd.nist.gov/vuln/detail/CVE-2022-2048 https://github.com/eclipse/jetty.project/security/advisories/GHSA-wgmr-mf83-7x4j
- https://bugzilla.redhat.com/show_bug.cgi?id=2116952
- https://access.redhat.com/errata/RHSA-2023:3663
- https://access.redhat.com/errata/RHSA-2023:0189
- https://access.redhat.com/errata/RHSA-2022:8652
- https://access.redhat.com/errata/RHSA-2023:0017
- https://access.redhat.com/errata/RHSA-2023:0777
- https://access.redhat.com/security/cve/cve-2022-2048
- https://github.com/eclipse/jetty.project/issues/7935
- https://security-tracker.debian.org/tracker/CVE-2022-2048
- https://exchange.xforce.ibmcloud.com/vulnerabilities/230670
- https://www.ibm.com/support/pages/node/6857999
Parent vulnerabilities
(Appears in the following advisories)
Frequently Asked Questions
What is CVE-2022-2048?
CVE-2022-2048 is a vulnerability in the Eclipse Jetty http2-server package that allows an attacker to cause a denial-of-service.
How does CVE-2022-2048 impact systems?
CVE-2022-2048 can lead to a denial-of-service attack if the client exhausts the HTTP/2 flow control window or congests the connection.
Which software is affected by CVE-2022-2048?
The affected software includes org.eclipse.jetty.http2:http2-server versions up to 11.0.10, 10.0.10, and 9.4.47.
What is the severity of CVE-2022-2048?
CVE-2022-2048 has a severity rating of high (7.5).
Where can I find more information about CVE-2022-2048?
You can find more information about CVE-2022-2048 at the following references: [GitHub Advisory](https://github.com/eclipse/jetty.project/security/advisories/GHSA-wgmr-mf83-7x4j), [NVD](https://nvd.nist.gov/vuln/detail/CVE-2022-2048), [Debian Security Advisory](https://www.debian.org/security/2022/dsa-5198).
- collector/github-advisory-latest
- alias/GHSA-wgmr-mf83-7x4j
- alias/CVE-2022-2048
- collector/github-advisory
- collector/redhat-cve
- collector/nvd-index
- collector/nvd-api
- collector/nvd-cve
- collector/security-tracker-debian
- agent/type
- agent/first-publish-date
- agent/author
- agent/severity
- agent/weakness
- collector/redhat-bugzilla
- source/Red Hat
- agent/software-canonical-lookup
- agent/description
- agent/references
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/event
- agent/tags
- collector/ibm-support
- source/IBM
- package-manager/maven
- package-manager/redhat
- vendor/eclipse
- canonical/eclipse jetty
- version/eclipse jetty/10.0.0
- version/eclipse jetty/11.0.0
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/10.0
- version/debian debian linux/11.0
- vendor/netapp
- canonical/netapp element plug-in for vcenter server
- canonical/netapp management services for element software and netapp hci
- canonical/netapp snapcenter
- canonical/netapp solidfire \& hci storage node
- canonical/netapp hci compute node
- vendor/jenkins
- canonical/jenkins jenkins
- package-manager/debian
- vendor/ibm
- canonical/ibm cognos command center
- version/ibm cognos command center/10.2.4.1