Eclipse Jetty: Insufficient Resource Pool
CVE-2022-2048 is a high-severity insufficient resource pool vulnerability in Eclipse Jetty from Eclipse Foundation, with a CVSS 3.1 base score of 7.5 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. Affected Eclipse Jetty versions: 9.4.0; 9.4.46 and earlier; 10.0.0, and others listed below. The record does not name a fixed version, so check the vendor advisory. There is no confirmed exploitation so far. EPSS estimates a 2.56% chance of exploitation within 30 days, higher than 85% of scored CVEs.
High severity with no evidence of exploitation so far.
What to do
- Update Jetty to 9.4.47 or 10.0.9 or 11.0.9, whichever matches your release line, or a later version.
- Update Jenkins to 2.263 or 2.361.1, whichever matches your release line, or a later version.
- Read the advisory on github.com for workarounds and exact fixed builds.
- Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| The Eclipse Foundation | Eclipse Jetty | 9.4.0; 9.4.46 and earlier; 10.0.0; 10.0.9 and earlier; 11.0.0; 11.0.9 and earlier | Not stated |
| Eclipse | Jetty | before 9.4.47; 10.0.0 up to, but not including, 10.0.9; 11.0.0 up to, but not including, 11.0.9 | 9.4.47, 10.0.9, 11.0.9 |
| Debian | Debian Linux | 10.0; 11.0 | Not stated |
| NetApp | Element Plug-in For Vcenter Server | Not specified in the record | Not stated |
| NetApp | Management Services For Element Software And Netapp Hci | Not specified in the record | Not stated |
| NetApp | Snapcenter | Not specified in the record | Not stated |
| NetApp | Solidfire & Hci Storage Node | Not specified in the record | Not stated |
| NetApp | Hci Compute Node | Not specified in the record | Not stated |
| Jenkins | Jenkins | before 2.263; before 2.361.1 | 2.263, 2.361.1 |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- NetworkCan be exploited remotely over a network, including the internet.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- NoneNo account or login is needed.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- NoneNo data is disclosed.
- Integrity
- NoneNothing can be modified.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. Scored by NVD.
| Scoring system | Score | Severity | Scored by |
|---|---|---|---|
| CVSS 3.1 | 7.5 | High | CNA (eclipse.org) |
| CVSS 3.1 | 7.5 | High | NVD |
| CVSS 2.0 | 5.0 | Medium | NVD |
Official description
In Eclipse Jetty HTTP/2 server implementation, when encountering an invalid HTTP/2 request, the error handling has a bug that can wind up not properly cleaning up the active connections and associated resources. This can lead to a Denial of Service scenario where there are no enough resources left to process good requests.
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Insufficient Resource Pool
The product's resource pool is not large enough to handle peak demand.
How developers prevent this class of flaw
- Do not perform resource-intensive transactions for unauthenticated users and/or invalid requests.
- Consider implementing a velocity check mechanism which would detect abusive behavior.
- Consider load balancing as an option to handle heavy loads.
Timeline
- CVE record published.
- Record last changed materially (score, affected products, status or references).
References
Advisories
- github.com/eclipse/jetty.project/security/advisories/GHSA-wgmr-mf83-7x4jThird Party Advisory
Third-party and government advisories
- openwall.com/lists/oss-security/2022/09/09/2Mailing List, Third Party Advisory
- lists.debian.org/debian-lts-announce/2022/08/msg00011.htmlMailing List, Third Party Advisory
- security.netapp.com/advisory/ntap-20220901-0006/Third Party Advisory
- debian.org/security/2022/dsa-5198Third Party Advisory
Other vulnerabilities in Eclipse Jetty
- 8.2 High severity
- 8.2 High severity
- 8.3 High severity
- 8.7 High severity
- 8.7 High severity
- 9.1 Critical severity
Spotted an error? Tell us.