CVE-2022-2191
published 2022-07-07CVE-2022-2191: In Eclipse Jetty versions 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, SslConnection does not release ByteBuffers from configured ByteBufferPool in…
PriorityP341high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
2.04%
78.9th percentile
In Eclipse Jetty versions 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, SslConnection does not release ByteBuffers from configured ByteBufferPool in case of error code paths.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | jetty9 | — | — |
| eclipse | jetty | 10.0.0 – 10.0.9 | — |
| eclipse | jetty | 11.0.0 – 11.0.9 | — |
| the_eclipse_foundation | eclipse_jetty | >= 10.0.0 < unspecified | unspecified |
| the_eclipse_foundation | eclipse_jetty | >= 11.0.0 < unspecified | unspecified |
| the_eclipse_foundation | eclipse_jetty | unspecified – 10.0.9 | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
osv7.5HIGH
vendor_debian7.5LOW
vendor_oracle7.5HIGH
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Jetty SslConnection does not release pooled ByteBuffers in case of errors
ghsa·2022-07-07
CVE-2022-2191 [HIGH] CWE-404 Jetty SslConnection does not release pooled ByteBuffers in case of errors
Jetty SslConnection does not release pooled ByteBuffers in case of errors
### Impact
`SslConnection` does not release `ByteBuffer`s in case of error code paths.
For example, TLS handshakes that require client-auth with clients that send expired certificates will trigger a TLS handshake errors and the `ByteBuffer`s used to process the TLS handshake will be leaked.
### Workarounds
Configure explicitly a `RetainableByteBufferPool` with `max[Heap|Direct]Memory` to limit the amount of memory that is leaked.
Eventually the pool will be full of "active" entries (the leaked ones) and will provide `ByteBuffer`s that will be GCed normally.
_With embedded-jetty_
``` java
int maxBucketSize = 1000;
long maxHeapMemory = 128 * 1024L * 1024L; // 128 MB
long maxDirectMemory = 128 * 1024L * 1024L; // 12
OSV
Jetty SslConnection does not release pooled ByteBuffers in case of errors
osv·2022-07-07
CVE-2022-2191 [HIGH] Jetty SslConnection does not release pooled ByteBuffers in case of errors
Jetty SslConnection does not release pooled ByteBuffers in case of errors
### Impact
`SslConnection` does not release `ByteBuffer`s in case of error code paths.
For example, TLS handshakes that require client-auth with clients that send expired certificates will trigger a TLS handshake errors and the `ByteBuffer`s used to process the TLS handshake will be leaked.
### Workarounds
Configure explicitly a `RetainableByteBufferPool` with `max[Heap|Direct]Memory` to limit the amount of memory that is leaked.
Eventually the pool will be full of "active" entries (the leaked ones) and will provide `ByteBuffer`s that will be GCed normally.
_With embedded-jetty_
``` java
int maxBucketSize = 1000;
long maxHeapMemory = 128 * 1024L * 1024L; // 128 MB
long maxDirectMemory = 128 * 1024L * 1024L; // 12
OSV
CVE-2022-2191: In Eclipse Jetty versions 10
osv·2022-07-07·CVSS 7.5
CVE-2022-2191 [HIGH] CVE-2022-2191: In Eclipse Jetty versions 10
In Eclipse Jetty versions 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, SslConnection does not release ByteBuffers from configured ByteBufferPool in case of error code paths.
Oracle
Oracle Oracle Communications Risk Matrix: Platform (Eclipse Jetty) — CVE-2022-2191
vendor_oracle·2022-10-15·CVSS 7.5
CVE-2022-2191 [HIGH] Oracle Oracle Communications Risk Matrix: Platform (Eclipse Jetty) — CVE-2022-2191
Oracle Oracle Communications Risk Matrix: Platform (Eclipse Jetty) vulnerability
CVE: CVE-2022-2191
CVSS: 7.5
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpuoct2022 (OCT 2022)
Red Hat
jetty-server: Improper release of ByteBuffers in SslConnections
vendor_redhat·2022-07-07·CVSS 7.5
CVE-2022-2191 [HIGH] CWE-404 jetty-server: Improper release of ByteBuffers in SslConnections
jetty-server: Improper release of ByteBuffers in SslConnections
In Eclipse Jetty versions 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, SslConnection does not release ByteBuffers from configured ByteBufferPool in case of error code paths.
A flaw was found in the Jetty-server package. This flaw allows an attacker to send invalid requests, causing a denial of service in the Jetty Server.
Statement: In Red Hat Satellite 6.9 we are using 9.4.x or below of jetty-server. Red Hat Satellite 6.10 is not using jetty-server anymore. This flaw only affects versions above 10.0.x or 11.0.x of jetty-server, therefore Red Hat Satellite 6.9 or 6.10 are not impacted by this vulnerability.
Package: jetty-server (A-MQ Clients 2) - Not affected
Package: jetty-server (Red Hat AMQ Broker 7) - Not aff
Debian
CVE-2022-2191: jetty9 - In Eclipse Jetty versions 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, S...
vendor_debian·2022·CVSS 7.5
CVE-2022-2191 [HIGH] CVE-2022-2191: jetty9 - In Eclipse Jetty versions 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, S...
In Eclipse Jetty versions 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, SslConnection does not release ByteBuffers from configured ByteBufferPool in case of error code paths.
Scope: local
bookworm: resolved
bullseye: resolved
forky: resolved
sid: resolved
trixie: resolved
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2022-07-07
Published