Denial Of Service (DoS)

🗓️ 12 Oct 2023 05:13:43Reported by Veracode Vulnerability DatabaseType

veracode🔗 sca.analysiscenter.veracode.com👁 44 Views

org.eclipse.jetty vulnerable to DoS attack due to HPACK header size limitation fla

Reporter	Title	Published	Views	Family All 116
IBM Security Bulletins	Security Bulletin: Vulnerabilities Addressed in IBM Tivoli Network Manager IP Edition (ITNM) version 4.2 Fix Pack 20 (4.2.0.20)	11 Nov 202411:31	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in jetty-http affects IBM Integrated Analytics System[CVE-2023-36478]	21 Nov 202407:31	–	ibm
IBM Security Bulletins	Security Bulletin: An Eclipse Jetty vulnerability affects IBM Rational Functional Tester	21 Dec 202317:17	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery Cartridge for IBM Cloud Pak for Data affected by vulnerability in Eclipse Jetty	31 Jan 202422:44	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM StreamSets Data Collector	22 Oct 202512:16	–	ibm
IBM Security Bulletins	Security Bulletin: Due to the use of jetty IBM webMethods BPM is vulnerable to multiple vulnerabilities	11 Mar 202620:59	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Cloud Pak for Multicloud Management	20 Mar 202517:08	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Control Center is affected by vulnerabilities in its dependencies (CVE-2022-45688, CVE-2023-28439, CVE-2023-33201, CVE-2023-41900, CVE-2023-36479, CVE-2023-40167, CVE-2023-36478, )	24 Mar 202514:16	–	ibm
IBM Security Bulletins	Security Bulletin: IBM InfoSphere Information Server is affected by Eclipse Jetty vulnerability (CVE-2023-36478)	29 Nov 202304:46	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Observability with Instana (OnPrem) is affected by multiple security vulnerabilities	10 Jul 202407:59	–	ibm

Vulners

Node

jetty9 jetty9Match9.4.33-1debian

AND

jetty9 jetty9Match9.4.38-1debian

AND

debian debian_linuxMatch999

jetty9 jetty9Match9.4.33-1debian

AND

jetty9 jetty9Match9.4.36-1debian

AND

debian debian_linuxMatch11

jetty9 jetty9Match9.4.16-0+deb10u1debian

AND

jetty9 jetty9Match9.4.15-1debian

AND

debian debian_linuxMatch10

jetty-runner jetty-runnerMatch9.4.44.20210927-r0java

AND

jetty-runner jetty-runnerMatch9.4.51.20230217-r2java

AND

jetty-runner jetty-runnerMatch9.4.51.20230217-r1java

AND

alpinelinux alpine_linuxMatch3.18

jetty-runner jetty-runnerMatch9.4.52.20230823-r0java

AND

jetty-runner jetty-runnerMatch9.4.51.20230217-r2java

AND

jetty-runner jetty-runnerMatch9.4.15.20190215-r0java

AND

jetty-runner jetty-runnerMatch9.4.51.20230217-r3java

AND

jetty-runner jetty-runnerMatch9.4.44.20210927-r0java

AND

jetty-runner jetty-runnerMatch9.4.15.20190215-r10java

AND

alpinelinux alpine_linuxMatchedge

jetty-runner jetty-runnerMatch9.4.44.20210927-r0java

AND

alpinelinux alpine_linuxMatch3.17

eclipse http3-qpackRange11.0.8–11.0.15java

eclipse http3-qpackRange10.0.8–10.0.15java

eclipse http2-hpackRange11.0.0-alpha0–11.0.15java

eclipse http2-hpackRange10.0.0-alpha0–10.0.15java

eclipse http2-hpackRange9.3.0.M0–9.4.52.v20230823java

Source	Link
github	www.github.com/eclipse/jetty.project/pull/9634
github	www.github.com/eclipse/jetty.project/commit/c3b6b47915458199f39b08d542669d31fddb8901
github	www.github.com/eclipse/jetty.project/commit/c3b6b47915458199f39b08d542669d31fddb8901
github	www.github.com/eclipse/jetty.project/commit/c7a4b05fc735e73e7522cb617c079045b709957b
github	www.github.com/advisories/GHSA-wgh7-54f2-x98r
github	www.github.com/eclipse/jetty.project/releases/tag/jetty-10.0.16
github	www.github.com/eclipse/jetty.project/releases/tag/jetty-11.0.16
github	www.github.com/eclipse/jetty.project/releases/tag/jetty-9.4.53.v20231009
github	www.github.com/eclipse/jetty.project/security/advisories/GHSA-wgh7-54f2-x98r
lists	www.lists.debian.org/debian-lts-announce/2023/10/msg00045.html

21 Jun 2024 20:33Current

7High risk

Vulners AI Score7

CVSS 3.17.5

EPSS0.01797