REDHAT-BUG-2365137: High severity mortbay jetty vulnerability
In Eclipse Jetty versions 12.0.0 to 12.0.16 included, an HTTP/2 client can specify a very large value for the HTTP/2 settings parameter SETTINGSMAXHEADERLISTSIZE. The Jetty HTTP/2 server does not perform validation on this setting, and tries to allocate a ByteBuffer of the specified capacity to encode HTTP responses, likely resulting in OutOfMemoryError being thrown, or even the JVM process exiting.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2365137?
The severity of REDHAT-BUG-2365137 is considered critical due to the potential for Denial of Service.
How do I fix REDHAT-BUG-2365137?
To fix REDHAT-BUG-2365137, update Eclipse Jetty to a version higher than 12.0.16.
What versions of Eclipse Jetty are affected by REDHAT-BUG-2365137?
Eclipse Jetty versions from 12.0.0 to 12.0.16 are affected by REDHAT-BUG-2365137.
What is the main issue reported in REDHAT-BUG-2365137?
The main issue in REDHAT-BUG-2365137 is that the Jetty HTTP/2 server does not validate the SETTINGS_MAX_HEADER_LIST_SIZE, leading to potential resource allocation problems.
What are the potential consequences of REDHAT-BUG-2365137?
The potential consequences of REDHAT-BUG-2365137 include Denial of Service due to excessive resource consumption.