Jetty is a Java based web server and servlet engine. An HTTP/2 SSL connection that is established and TCP congested will be leaked when it times out. An attacker can cause many connections to end up in this state, and the server may run out of file descriptors, eventually causing the server to stop accepting new connections from valid clients. The vulnerability is patched in 9.4.54, 10.0.20, 11.0.20, and 12.0.6.
References
| Link | Resource |
|---|---|
| http://www.openwall.com/lists/oss-security/2024/03/20/2 | Mailing List Third Party Advisory |
| http://www.openwall.com/lists/oss-security/2024/03/20/2 | Mailing List Third Party Advisory |
| https://github.com/jetty/jetty.project/issues/11256 | Issue Tracking |
| https://github.com/jetty/jetty.project/issues/11256 | Issue Tracking |
| https://github.com/jetty/jetty.project/security/advisories/GHSA-rggv-cv7r-mw98 | Vendor Advisory |
| https://github.com/jetty/jetty.project/security/advisories/GHSA-rggv-cv7r-mw98 | Vendor Advisory |
| https://lists.debian.org/debian-lts-announce/2024/04/msg00002.html | Mailing List |
| https://lists.debian.org/debian-lts-announce/2024/04/msg00002.html | Mailing List |
| https://security.netapp.com/advisory/ntap-20240329-0001/ | Third Party Advisory |
| https://security.netapp.com/advisory/ntap-20240329-0001/ | Third Party Advisory |
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
History
13 Feb 2025, 18:16
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | Jetty is a Java based web server and servlet engine. An HTTP/2 SSL connection that is established and TCP congested will be leaked when it times out. An attacker can cause many connections to end up in this state, and the server may run out of file descriptors, eventually causing the server to stop accepting new connections from valid clients. The vulnerability is patched in 9.4.54, 10.0.20, 11.0.20, and 12.0.6. |
07 Feb 2025, 17:36
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Netapp bluexp
Netapp Netapp active Iq Unified Manager Debian debian Linux Eclipse jetty Eclipse Debian |
|
| References | () http://www.openwall.com/lists/oss-security/2024/03/20/2 - Mailing List, Third Party Advisory | |
| References | () https://github.com/jetty/jetty.project/issues/11256 - Issue Tracking | |
| References | () https://github.com/jetty/jetty.project/security/advisories/GHSA-rggv-cv7r-mw98 - Vendor Advisory | |
| References | () https://security.netapp.com/advisory/ntap-20240329-0001/ - Third Party Advisory | |
| References | () https://lists.debian.org/debian-lts-announce/2024/04/msg00002.html - Mailing List | |
| CPE | cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* cpe:2.3:a:netapp:bluexp:-:*:*:*:*:*:*:* cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:* cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:* |
|
| CWE | CWE-770 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
01 May 2024, 18:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
06 Apr 2024, 22:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
29 Mar 2024, 13:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
26 Feb 2024, 16:32
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-02-26 16:27
Updated : 2025-02-13 18:16
NVD link : CVE-2024-22201
Mitre link : CVE-2024-22201
JSON object : View
Products Affected
debian
- debian_linux
netapp
- active_iq_unified_manager
- bluexp
eclipse
- jetty
CWE
CWE-770
Allocation of Resources Without Limits or Throttling