CVE-2024-9823
Fixed in a distro release EPSS <1%CVSS 5.3
There exists a security vulnerability in Jetty's DosFilter which can be exploited by unauthorized users to cause remote denial-of-service (DoS) attack on the server using DosFilter. By repeatedly sending crafted requests, attackers can trigger OutofMemory errors and exhaust the server's memory finally.
Products: Eclipse Foundation Jetty, Eclipse Jetty Jetty, eclipse jetty
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.eclipse.jetty.ee10:jetty-ee10-servlets | 12.0.3 |
| Maven | org.eclipse.jetty.ee8:jetty-ee8-servlets | 12.0.3 |
| Maven | org.eclipse.jetty.ee9:jetty-ee9-servlets | 12.0.3 |
| Maven | org.eclipse.jetty:jetty-servlets | 9.4.54 |
| Maven | org.eclipse.jetty:jetty-servlets | 10.0.18 |
| Maven | org.eclipse.jetty:jetty-servlets | 11.0.18 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux 2 | jetty-annotations | 9.0.3-8.amzn2.0.4 |
| Amazon Linux 2 | jetty-ant | 9.0.3-8.amzn2.0.4 |
| Amazon Linux 2 | jetty-client | 9.0.3-8.amzn2.0.4 |
| Amazon Linux 2 | jetty-continuation | 9.0.3-8.amzn2.0.4 |
| Amazon Linux 2 | jetty-deploy | 9.0.3-8.amzn2.0.4 |
| Amazon Linux 2 | jetty-http | 9.0.3-8.amzn2.0.4 |
| Amazon Linux 2 | jetty-io | 9.0.3-8.amzn2.0.4 |
| Amazon Linux 2 | jetty-jaas | 9.0.3-8.amzn2.0.4 |
| Amazon Linux 2 | jetty-jaspi | 9.0.3-8.amzn2.0.4 |
| Amazon Linux 2 | jetty-javadoc | 9.0.3-8.amzn2.0.4 |
| Amazon Linux 2 | jetty-jmx | 9.0.3-8.amzn2.0.4 |
| Amazon Linux 2 | jetty-jndi | 9.0.3-8.amzn2.0.4 |
| Amazon Linux 2 | jetty-jsp | 9.0.3-8.amzn2.0.4 |
| Amazon Linux 2 | jetty-jspc-maven-plugin | 9.0.3-8.amzn2.0.4 |
| Amazon Linux 2 | jetty-maven-plugin | 9.0.3-8.amzn2.0.4 |
| Amazon Linux 2 | jetty-monitor | 9.0.3-8.amzn2.0.4 |
| Amazon Linux 2 | jetty-plus | 9.0.3-8.amzn2.0.4 |
| Amazon Linux 2 | jetty-project | 9.0.3-8.amzn2.0.4 |
| Amazon Linux 2 | jetty-proxy | 9.0.3-8.amzn2.0.4 |
| Amazon Linux 2 | jetty-rewrite | 9.0.3-8.amzn2.0.4 |
| Amazon Linux 2 | jetty-runner | 9.0.3-8.amzn2.0.4 |
| Amazon Linux 2 | jetty-security | 9.0.3-8.amzn2.0.4 |
| Amazon Linux 2 | jetty-server | 9.0.3-8.amzn2.0.4 |
| Amazon Linux 2 | jetty-servlet | 9.0.3-8.amzn2.0.4 |
| Amazon Linux 2 | jetty-servlets | 9.0.3-8.amzn2.0.4 |
| Amazon Linux 2 | jetty-start | 9.0.3-8.amzn2.0.4 |
| Amazon Linux 2 | jetty-util | 9.0.3-8.amzn2.0.4 |
| Amazon Linux 2 | jetty-util-ajax | 9.0.3-8.amzn2.0.4 |
| Amazon Linux 2 | jetty-webapp | 9.0.3-8.amzn2.0.4 |
| Amazon Linux 2 | jetty-websocket-api | 9.0.3-8.amzn2.0.4 |
| Amazon Linux 2 | jetty-websocket-client | 9.0.3-8.amzn2.0.4 |
| Amazon Linux 2 | jetty-websocket-common | 9.0.3-8.amzn2.0.4 |
| Amazon Linux 2 | jetty-websocket-parent | 9.0.3-8.amzn2.0.4 |
| Amazon Linux 2 | jetty-websocket-server | 9.0.3-8.amzn2.0.4 |
| Amazon Linux 2 | jetty-websocket-servlet | 9.0.3-8.amzn2.0.4 |
| Amazon Linux 2 | jetty-xml | 9.0.3-8.amzn2.0.4 |
| Chainguard | apache-hop | 2.15.0-r2 |
| Chainguard | apache-hop-fips | 2.15.0-r2 |
| Chainguard | cassandra-reaper | 4.0.1-r1 |
| Chainguard | hadoop-fips-3.3.6 | no fix |
| Chainguard | hadoop-fips-3.4.2 | no fix |
| Chainguard | hadoop-fips-3.5 | no fix |
| Chainguard | hadoop-fips-3.5 | 3.5.0-r12 |
| Chainguard | spark-3.5-scala-2.13 | 3.5.7-r2 |
| Chainguard | spark-fips-3.5-scala-2.13 | 3.5.8-r3 |
| Debian 11 | jetty9 | 9.4.57-0+deb11u1 |
| Debian 12 | jetty9 | 9.4.57-0+deb12u1 |
| Debian 13 | jetty9 | 9.4.54-1 |
| Debian 14 | jetty9 | 9.4.54-1 |
| Ubuntu 14.04 LTS | jetty | no fix |
| Ubuntu 16.04 LTS | jetty | no fix |
| Ubuntu 16.04 LTS | jetty9 | no fix |
| Ubuntu 18.04 LTS | jetty9 | no fix |
| Ubuntu 20.04 LTS | jetty9 | no fix |
| Ubuntu 22.04 LTS | jetty9 | no fix |
| Ubuntu 24.04 LTS | jetty9 | no fix |
| Wolfi | cassandra-reaper | 4.0.1-r1 |