jetty12 - security update
jetty12 - security update
- Update to 12.0.17-3.1~deb13u1
Published Updated
PatchFirst · Latest vulnerabilities
jetty12 vulnerabilities · Page 2
Vulnerabilities published for jetty12 in the last 30 days: 8. Listed in the KEV catalogue: 0.
Vulnerabilities: 23
MadeYouReset HTTP/2 vulnerability
In Eclipse Jetty, versions <=9.4.57, <=10.0.25, <=11.0.25, <=12.0.21, <=12.1.0.alpha2, an HTTP/2 client may trigger the server to send RST_STREAM frames, for example by sending frames that are malformed or that should not be sent in a particular stream state, therefore forcing the server to consume resources such as CPU and memory. For example, a client can open a stream and then send WINDOW_UPDATE frames with window size increment of 0, which is illegal. Per specification https://www.rfc-editor.org/rfc/rfc9113.html#name-window_update , the server should send a RST_STREAM frame. The client can now open another stream and send another bad W
- Update to 12.0.17-3.1~deb13u1
Published UpdatedEclipse Jetty HTTP clients can increase memory allocation
In Eclipse Jetty versions 12.0.0 to 12.0.16 included, an HTTP/2 client can specify a very large value for the HTTP/2 settings parameter SETTINGS_MAX_HEADER_LIST_SIZE. The Jetty HTTP/2 server does not perform validation on this setting, and tries to allocate a ByteBuffer of the specified capacity to encode HTTP responses, likely resulting in OutOfMemoryError being thrown, or even the JVM process exiting.
- Update to 12.0.17-1
Published Updated
Check your server
Check your installed stack and versions against the current vulnerability feeds.