CVE-2021-28165
Fixed in a distro release EPSS 54%CVSS 7.5
In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invalid TLS frame.
Products: The Eclipse Foundation Eclipse Jetty
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.eclipse.jetty:jetty-server | 9.4.39 |
| Maven | org.eclipse.jetty:jetty-server | 10.0.2 |
| Maven | org.eclipse.jetty:jetty-server | 11.0.2 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | hadoop-fips-3.3.6 | no fix |
| Chainguard | hadoop-fips-3.4.2 | no fix |
| Chainguard | hadoop-fips-3.5 | no fix |
| Debian 10 | jetty9 | 9.4.16-0+deb10u1 |
| Debian 12 | jetty9 | 9.4.39-1 |
| Debian 13 | jetty9 | 9.4.39-1 |
| Debian 14 | jetty9 | 9.4.39-1 |
| Red Hat devtools 2021 | rh-eclipse-jetty | 0:9.4.40-1.1.el7_9 |
| Red Hat devtools 2021 | rh-eclipse-jetty-client | 0:9.4.40-1.1.el7_9 |
| Red Hat devtools 2021 | rh-eclipse-jetty-continuation | 0:9.4.40-1.1.el7_9 |
| Red Hat devtools 2021 | rh-eclipse-jetty-http | 0:9.4.40-1.1.el7_9 |
| Red Hat devtools 2021 | rh-eclipse-jetty-io | 0:9.4.40-1.1.el7_9 |
| Red Hat devtools 2021 | rh-eclipse-jetty-jaas | 0:9.4.40-1.1.el7_9 |
| Red Hat devtools 2021 | rh-eclipse-jetty-javadoc | 0:9.4.40-1.1.el7_9 |
| Red Hat devtools 2021 | rh-eclipse-jetty-jmx | 0:9.4.40-1.1.el7_9 |
| Red Hat devtools 2021 | rh-eclipse-jetty-security | 0:9.4.40-1.1.el7_9 |
| Red Hat devtools 2021 | rh-eclipse-jetty-server | 0:9.4.40-1.1.el7_9 |
| Red Hat devtools 2021 | rh-eclipse-jetty-servlet | 0:9.4.40-1.1.el7_9 |
| Red Hat devtools 2021 | rh-eclipse-jetty-util | 0:9.4.40-1.1.el7_9 |
| Red Hat devtools 2021 | rh-eclipse-jetty-util-ajax | 0:9.4.40-1.1.el7_9 |
| Red Hat devtools 2021 | rh-eclipse-jetty-webapp | 0:9.4.40-1.1.el7_9 |
| Red Hat devtools 2021 | rh-eclipse-jetty-xml | 0:9.4.40-1.1.el7_9 |
| Red Hat openshift 4.7 | cri-tools | 0:1.20.0-2.el7 |
| Red Hat openshift 4.7 | cri-tools | 0:1.20.0-2.el8 |
| Red Hat openshift 4.7 | cri-tools-debuginfo | 0:1.20.0-2.el8 |
| Red Hat openshift 4.7 | cri-tools-debuginfo | 0:1.20.0-2.el7 |
| Red Hat openshift 4.7 | cri-tools-debugsource | 0:1.20.0-2.el8 |
| Red Hat openshift 4.7 | jenkins | 0:2.277.3.1620393611-1.el8 |
| Red Hat openshift 4.7 | runc | 0:1.0.0-95.rhaos4.8.gitcd80260.el8 |
| Red Hat openshift 4.7 | runc | 0:1.0.0-95.rhaos4.8.gitcd80260.el7 |
| Red Hat openshift 4.7 | runc-debuginfo | 0:1.0.0-95.rhaos4.8.gitcd80260.el7 |
| Red Hat openshift 4.7 | runc-debuginfo | 0:1.0.0-95.rhaos4.8.gitcd80260.el8 |
| Red Hat openshift 4.7 | runc-debugsource | 0:1.0.0-95.rhaos4.8.gitcd80260.el8 |
| SUSE Linux Enterprise Module for Development Tools 15 SP2 | jetty-minimal | 9.4.42-3.9.1 |
| SUSE Linux Enterprise Module for Development Tools 15 SP3 | jetty-minimal | 9.4.42-3.9.1 |
| Ubuntu 18.04 LTS | equinox-bundles | no fix |
| Ubuntu 20.04 LTS | equinox-bundles | no fix |
| Ubuntu 22.04 LTS | equinox-bundles | no fix |
| openSUSE Leap 15.3 | jetty-minimal | 9.4.42-3.9.1 |
| openSUSE Leap 15.3 | jetty-websocket | 9.4.42-3.9.1 |