CVE-2022-2191
Fixed upstream EPSS 2%CVSS 7.5
In Eclipse Jetty versions 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, SslConnection does not release ByteBuffers from configured ByteBufferPool in case of error code paths.
Products: The Eclipse Foundation Eclipse Jetty
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.eclipse.jetty:jetty-server | 10.0.10 |
| Maven | org.eclipse.jetty:jetty-server | 11.0.10 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu 14.04 LTS | jetty | no fix |
| Ubuntu 14.04 LTS | jetty8 | no fix |
| Ubuntu 16.04 LTS | jetty | no fix |
| Ubuntu 16.04 LTS | jetty8 | no fix |