Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
githubGitHub Advisory DatabaseGHSA-X3RH-M7VP-35F2
HistoryAug 05, 2020 - 2:52 p.m.

Operation on a Resource after Expiration or Release in Jetty Server

2020-08-0514:52:59
CWE-672
CWE-675
GitHub Advisory Database
github.com
197

9.4 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.005 Low

EPSS

Percentile

76.2%

JSON

In Eclipse Jetty, versions 9.4.27.v20200227 to 9.4.29.v20200521, in case of too large response headers, Jetty throws an exception to produce an HTTP 431 error. When this happens, the ByteBuffer containing the HTTP response headers is released back to the ByteBufferPool twice. Because of this double release, two threads can acquire the same ByteBuffer from the pool and while thread1 is about to use the ByteBuffer to write response1 data, thread2 fills the ByteBuffer with response2 data. Thread1 then proceeds to write the buffer that now contains response2 data. This results in client1, which issued request1 and expects responses, to see response2 which could contain sensitive data belonging to client2 (HTTP session ids, authentication credentials, etc.).

References

Related

checkpoint_advisories 1
prion 1
osv 2
veracode 1
thn 1
openvas 19
ibm 6
nessus 6
redhatcve 1
githubexploit 1
freebsd 1
cve 1
ubuntucve 1
debiancve 1
fedora 15
redhat 5
oracle 2
checkpoint_advisories
checkpoint_advisories
Jenkins Jetty Buffer Overflow (CVE-2019-17638)
2020-08-25 00:00:00
prion
prion
Design/Logic Flaw
2020-07-09 18:15:00
osv
osv
Operation on a Resource after Expiration or Release in Jetty Server
2020-08-05 14:52:59
CVE-2019-17638
2020-07-09 18:15:10
veracode
veracode
Information Disclosure
2020-07-13 06:03:25
thn
thn
Critical Jenkins Server Vulnerability Could Leak Sensitive Information
2020-08-18 09:55:00
openvas
openvas
Eclipse Jetty Vulnerability (CVE-2019-17638) - Windows
2020-07-15 00:00:00
Jenkins < 2.243, < 2.235.5 LTS Buffer Corruption in bundled Jetty - Windows
2020-08-18 00:00:00
Jenkins < 2.243, < 2.235.5 LTS Buffer Corruption in bundled Jetty - Linux
2020-08-18 00:00:00
ibm
ibm
Security Bulletin: IBM MQ is affected by a vulnerability in Eclipse Jetty (CVE-2019-17638)
2020-12-23 13:52:05
Security Bulletin: Publicly disclosed vulnerability found by vFinder in IBM eDiscovery Analyzer
2020-09-15 19:39:42
Security Bulletin: i2 Analyze has an information disclosure vulnerability (CVE-2019-17638)
2021-07-29 07:55:08
nessus
nessus
FreeBSD : jenkins -- Buffer corruption in bundled Jetty (09ea1b08-1d3e-4bf2-91a1-d6573f4da3d8)
2020-08-18 00:00:00
Jenkins < 2.235.5 LTS / 2.243 Information Disclosure Vulnerability
2020-08-21 00:00:00
Fedora 32 : 1:ecj / 1:eclipse / 1:eclipse-emf / 2:eclipse-cdt / batik / etc (2020-cf8ef2f333)
2020-09-01 00:00:00
redhatcve
redhatcve
CVE-2019-17638
2020-08-03 20:14:33
githubexploit
githubexploit
Exploit for Operation on a Resource after Expiration or Release in Eclipse Jetty
2021-02-04 05:07:42
freebsd
freebsd
jenkins -- Buffer corruption in bundled Jetty
2020-08-17 00:00:00
cve
cve
CVE-2019-17638
2020-07-09 18:15:00
ubuntucve
ubuntucve
CVE-2019-17638
2020-07-09 00:00:00
debiancve
debiancve
CVE-2019-17638
2020-07-09 18:15:00
fedora
fedora
[SECURITY] Fedora 32 Update: eclipse-m2e-core-1.16.1-1.fc32
2020-08-31 15:50:29
[SECURITY] Fedora 32 Update: ecj-4.16-4.fc32
2020-08-31 15:50:28
[SECURITY] Fedora 32 Update: eclipse-ecf-3.14.8-4.fc32
2020-08-31 15:50:28
redhat
redhat
(RHSA-2020:4223) Important: OpenShift Container Platform 3.11.306 jenkins security update
2020-10-22 10:29:39
(RHSA-2020:4220) Important: OpenShift Container Platform 4.4.27 openshift-jenkins-2-container security update
2020-10-13 07:58:37
(RHSA-2020:3841) Important: OpenShift Container Platform 4.5.13 jenkins security update
2020-09-30 18:49:53
oracle
oracle
Oracle Critical Patch Update Advisory - April 2021
2021-04-20 00:00:00
Oracle Critical Patch Update Advisory - October 2020
2020-10-20 00:00:00

9.4 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.005 Low

EPSS

Percentile

76.2%

JSON
Related for GHSA-X3RH-M7VP-35F2
checkpoint_advisories1prion1osv2veracode1thn1openvas19ibm6nessus6redhatcve1githubexploit1freebsd1cve1ubuntucve1debiancve1fedora15redhat5oracle2