jetty12 - security update
jetty12 - security update
- Mettez à jour vers 12.0.17-3.1~deb13u1
Publication Mise à jour
PatchFirst · Vulnérabilités récentes
Vulnérabilités de jetty12 · Page n° 2
Vulnérabilités publiées pour jetty12 au cours des 30 derniers jours : 8. Présentes dans le catalogue KEV : 0.
Vulnérabilités : 23
MadeYouReset HTTP/2 vulnerability
In Eclipse Jetty, versions <=9.4.57, <=10.0.25, <=11.0.25, <=12.0.21, <=12.1.0.alpha2, an HTTP/2 client may trigger the server to send RST_STREAM frames, for example by sending frames that are malformed or that should not be sent in a particular stream state, therefore forcing the server to consume resources such as CPU and memory. For example, a client can open a stream and then send WINDOW_UPDATE frames with window size increment of 0, which is illegal. Per specification https://www.rfc-editor.org/rfc/rfc9113.html#name-window_update , the server should send a RST_STREAM frame. The client can now open another stream and send another bad W
- Mettez à jour vers 12.0.17-3.1~deb13u1
Publication Mise à jourEclipse Jetty HTTP clients can increase memory allocation
In Eclipse Jetty versions 12.0.0 to 12.0.16 included, an HTTP/2 client can specify a very large value for the HTTP/2 settings parameter SETTINGS_MAX_HEADER_LIST_SIZE. The Jetty HTTP/2 server does not perform validation on this setting, and tries to allocate a ByteBuffer of the specified capacity to encode HTTP responses, likely resulting in OutOfMemoryError being thrown, or even the JVM process exiting.
- Mettez à jour vers 12.0.17-1
Publication Mise à jour
Vérifiez votre serveur
Comparez votre pile et les versions installées aux bases de vulnérabilités actuelles.