CVE-2022-2048
Fixed in a distro release EPSS 3%CVSS 7.5
In Eclipse Jetty HTTP/2 server implementation, when encountering an invalid HTTP/2 request, the error handling has a bug that can wind up not properly cleaning up the active connections and associated resources. This can lead to a Denial of Service scenario where there are no enough resources left to process good requests.
Products: The Eclipse Foundation Eclipse Jetty
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.eclipse.jetty.http2:http2-server | 9.4.47 |
| Maven | org.eclipse.jetty.http2:http2-server | 10.0.10 |
| Maven | org.eclipse.jetty.http2:http2-server | 11.0.10 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian:10 | jetty9 | 9.4.16-0+deb10u2 |
| Debian:11 | jetty9 | 9.4.39-3+deb11u1 |
| Debian:12 | jetty9 | 9.4.48-1 |
| Debian:13 | jetty9 | 9.4.48-1 |
| Debian:14 | jetty9 | 9.4.48-1 |
| Red Hat:ocp_tools:4.11 | jenkins | 0:2.401.1.1686831596-3.el8 |
| Red Hat:ocp_tools:4.11 | jenkins-2-plugins | 0:4.11.1686831822-1.el8 |
| Red Hat:openshift:4.8 | jenkins | 0:2.361.1.1672840472-1.el8 |
| Red Hat:openshift:4.8 | jenkins-2-plugins | 0:4.8.1672842762-1.el8 |
| Red Hat:openshift:4.9 | jenkins | 0:2.361.1.1675668150-1.el8 |
| Red Hat:openshift:4.9 | jenkins-2-plugins | 0:4.9.1675668922-1.el8 |
| Ubuntu:14.04:LTS | jetty | no fix |
| Ubuntu:14.04:LTS | jetty8 | no fix |
| Ubuntu:16.04:LTS | jetty | no fix |
| Ubuntu:16.04:LTS | jetty8 | no fix |
| Ubuntu:16.04:LTS | jetty9 | no fix |
| Ubuntu:18.04:LTS | jetty9 | no fix |
| Ubuntu:20.04:LTS | jetty9 | no fix |
| Ubuntu:22.04:LTS | jetty9 | no fix |