REDHAT-BUG-2266136: Medium severity Mortbay Jetty vulnerability
Jetty is a Java based web server and servlet engine. An HTTP/2 SSL connection that is established and TCP congested will be leaked when it times out. An attacker can cause many connections to end up in this state, and the server may run out of file descriptors, eventually causing the server to stop accepting new connections from valid clients. The vulnerability is patched in 9.4.54, 10.0.20, 11.0.20, and 12.0.6.
https://github.com/jetty/jetty.project/issues/11256 https://github.com/jetty/jetty.project/security/advisories/GHSA-rggv-cv7r-mw98
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
jettyto a version that resolves this vulnerability.Fixed in 9.4.54 - Upgrade
Upgrade
jettyto a version that resolves this vulnerability.Fixed in 10.0.20 - Upgrade
Upgrade
jettyto a version that resolves this vulnerability.Fixed in 11.0.20 - Upgrade
Upgrade
jettyto a version that resolves this vulnerability.Fixed in 12.0.6
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2266136?
The severity of REDHAT-BUG-2266136 is high due to the potential for denial of service attacks that can exhaust server resources.
How do I fix REDHAT-BUG-2266136?
To fix REDHAT-BUG-2266136, update to the latest supported version of Eclipse Jetty that is above 9.4.54, 10.0.20, 11.0.20, or 12.0.6.
What causes the vulnerability REDHAT-BUG-2266136?
REDHAT-BUG-2266136 is caused by an HTTP/2 SSL connection leak during TCP congestion which can lead to resource exhaustion.
Who is affected by REDHAT-BUG-2266136?
Users of Eclipse Jetty versions 9.4.54 and lower, 10.0.20 and lower, 11.0.20 and lower, and 12.0.6 and lower are affected by REDHAT-BUG-2266136.
Can REDHAT-BUG-2266136 lead to a service outage?
Yes, if exploited, REDHAT-BUG-2266136 can lead to a service outage due to the exhaustion of file descriptors.