REDHAT-BUG-2266136
First published: Mon Feb 26 2024(Updated: )
Jetty is a Java based web server and servlet engine. An HTTP/2 SSL connection that is established and TCP congested will be leaked when it times out. An attacker can cause many connections to end up in this state, and the server may run out of file descriptors, eventually causing the server to stop accepting new connections from valid clients. The vulnerability is patched in 9.4.54, 10.0.20, 11.0.20, and 12.0.6. <a href="https://github.com/jetty/jetty.project/issues/11256">https://github.com/jetty/jetty.project/issues/11256</a> <a href="https://github.com/jetty/jetty.project/security/advisories/GHSA-rggv-cv7r-mw98">https://github.com/jetty/jetty.project/security/advisories/GHSA-rggv-cv7r-mw98</a>
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Eclipse Jetty | <9.4.54<10.0.20<11.0.20<12.0.6 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/jetty/jetty.project/issues/11256
- https://github.com/jetty/jetty.project/security/advisories/GHSA-rggv-cv7r-mw98
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2266137
- https://access.redhat.com/errata/RHSA-2024:3636
- https://access.redhat.com/errata/RHSA-2024:3634
- https://access.redhat.com/errata/RHSA-2024:3635
- https://access.redhat.com/errata/RHSA-2024:4597
- https://access.redhat.com/errata/RHSA-2024:4873
- https://access.redhat.com/errata/RHSA-2024:4884
- https://bugzilla.redhat.com/show_bug.cgi?id=2266136
Frequently Asked Questions
What is the severity of REDHAT-BUG-2266136?
The severity of REDHAT-BUG-2266136 is high due to the potential for denial of service attacks that can exhaust server resources.
How do I fix REDHAT-BUG-2266136?
To fix REDHAT-BUG-2266136, update to the latest supported version of Eclipse Jetty that is above 9.4.54, 10.0.20, 11.0.20, or 12.0.6.
What causes the vulnerability REDHAT-BUG-2266136?
REDHAT-BUG-2266136 is caused by an HTTP/2 SSL connection leak during TCP congestion which can lead to resource exhaustion.
Who is affected by REDHAT-BUG-2266136?
Users of Eclipse Jetty versions 9.4.54 and lower, 10.0.20 and lower, 11.0.20 and lower, and 12.0.6 and lower are affected by REDHAT-BUG-2266136.
Can REDHAT-BUG-2266136 lead to a service outage?
Yes, if exploited, REDHAT-BUG-2266136 can lead to a service outage due to the exhaustion of file descriptors.
- agent/severity
- agent/first-publish-date
- agent/type
- agent/description
- agent/event
- agent/references
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2024-22201
- agent/last-modified-date
- agent/source
- agent/tags
- agent/softwarecombine
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/eclipse
- canonical/eclipse jetty