CVE-2023-36478
published 2023-10-10CVE-2023-36478: Eclipse Jetty provides a web server and servlet container. In versions 11.0.0 through 11.0.15, 10.0.0 through 10.0.15, and 9.0.0 through 9.4.52, an integer…
PriorityP343high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
3.75%
88.7th percentile
Eclipse Jetty provides a web server and servlet container. In versions 11.0.0 through 11.0.15, 10.0.0 through 10.0.15, and 9.0.0 through 9.4.52, an integer overflow in `MetaDataBuilder.checkSize` allows for HTTP/2 HPACK header values to
exceed their size limit. `MetaDataBuilder.java` determines if a header name or value exceeds the size limit, and throws an exception if the limit is exceeded. However, when length is very large and huffman is true, the multiplication by 4 in line 295
will overflow, and length will become negative. `(_size+length)` will now be negative, and the check on line 296 will not be triggered. Furthermore, `MetaDataBuilder.checkSize` allows for user-entered HPACK header value sizes to be negative, potentially leading to a very large buffer allocation later on when the user-entered size is multiplied by 2. This means that if a user provides a negative length value (or, more precisely, a length value which, when multiplied by the 4/3 fudge factor, is negative), and this length value is a very large positive number when multiplied by 2, then the user can cause a very large buffer to be allocated on the server. Users of HTTP/2 can be impacted by a remote denial of service attack. The issue has been fixed in versions 11.0.16, 10.0.16, and 9.4.53. There are no known workarounds.
Affected
16 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| atlassian | bitbucket_data_center | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | jetty9 | < jetty9 9.4.50-4+deb12u2 (bookworm) | jetty9 9.4.50-4+deb12u2 (bookworm) |
| eclipse | jetty | >= 10.0.0 < 10.0.16 | 10.0.16 |
| eclipse | jetty | >= 11.0.0 < 11.0.16 | 11.0.16 |
| eclipse | jetty | >= 9.3.0 < 9.4.53 | 9.4.53 |
| eclipse | jetty.project | — | — |
| eclipse | jetty.project | — | — |
| eclipse | jetty.project | — | — |
| jenkins | jenkins | < 2.414.3 | 2.414.3 |
| jenkins | jenkins | < 2.428 | 2.428 |
| jenkins | jenkins_core | — | — |
| jenkins | jenkins_lts | — | — |
| jenkins | jenkins_weekly | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
osv7.5HIGH
vendor_debian7.5HIGH
vendor_oracle7.5HIGH
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Oracle
Oracle Oracle Fusion Middleware Risk Matrix: Containers (Eclipse Jetty) — CVE-2023-36478
vendor_oracle·2024-07-15·CVSS 7.5
CVE-2023-36478 [HIGH] Oracle Oracle Fusion Middleware Risk Matrix: Containers (Eclipse Jetty) — CVE-2023-36478
Oracle Oracle Fusion Middleware Risk Matrix: Containers (Eclipse Jetty) vulnerability
CVE: CVE-2023-36478
CVSS: 7.5
Protocol: HTTP/2
Remote exploit: Yes
Affected versions: Network
Advisory: cpujul2024 (JUL 2024)
Atlassian
CVE-2023-36478: DoS (Denial of Service) org.eclipse.jetty:jetty-http Dependency in Bitbucket Data Center and Server
vendor_atlassian·2024-01-16·CVSS 7.5
CVE-2023-36478 [HIGH] CVE-2023-36478: DoS (Denial of Service) org.eclipse.jetty:jetty-http Dependency in Bitbucket Data Center and Server
CVE-2023-36478: DoS (Denial of Service) org.eclipse.jetty:jetty-http Dependency in Bitbucket Data Center and Server
DoS (Denial of Service) org.eclipse.jetty:jetty-http Dependency in Bitbucket Data Center and Server
CVE: CVE-2023-36478
Severity: HIGH
Affected products: Bitbucket Data Center
Oracle
Oracle Oracle Communications Risk Matrix: Platform (Eclipse Jetty) — CVE-2023-36478
vendor_oracle·2024-01-15·CVSS 7.5
CVE-2023-36478 [HIGH] Oracle Oracle Communications Risk Matrix: Platform (Eclipse Jetty) — CVE-2023-36478
Oracle Oracle Communications Risk Matrix: Platform (Eclipse Jetty) vulnerability
CVE: CVE-2023-36478
CVSS: 7.5
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpujan2024 (JAN 2024)
Jenkins
Jenkins Security Advisory 2023-10-18
vendor_jenkins·2023-10-18·CVSS 7.5
CVE-2023-36478 [HIGH] Jenkins Security Advisory 2023-10-18
Title: Jenkins Security Advisory 2023-10-18
Jenkins Security Advisory 2023-10-18
Jenkins Security Home
For Administrators
Overview
Terminology
Vulnerabilities and Scoring
Security Advisories
Security Issues
Advisory Schedule
Vulnerabilities in Plugins
How We Fix Security Issues
For Reporters
Reporting Vulnerabilities
Jenkins CNA
For Maintainers
Overview
Vulnerabilities in Plugins
Jenkins Security Team
About
Contributions
This advisory announces vulnerabilities in the following Jenkins deliverables:
Jenkins (core)
Descriptions
HTTP/2 denial of service vulnerabilities in bundled Jetty
SECURITY-3291
/
CVE-2023-36478, CVE-2023-44487
Severity (CVSS):
High
Description:
Jenkins b
Red Hat
jetty: hpack header values cause denial of service in http/2
vendor_redhat·2023-10-10·CVSS 7.5
CVE-2023-36478 [HIGH] CWE-190 jetty: hpack header values cause denial of service in http/2
jetty: hpack header values cause denial of service in http/2
Eclipse Jetty provides a web server and servlet container. In versions 11.0.0 through 11.0.15, 10.0.0 through 10.0.15, and 9.0.0 through 9.4.52, an integer overflow in `MetaDataBuilder.checkSize` allows for HTTP/2 HPACK header values to
exceed their size limit. `MetaDataBuilder.java` determines if a header name or value exceeds the size limit, and throws an exception if the limit is exceeded. However, when length is very large and huffman is true, the multiplication by 4 in line 295
will overflow, and length will become negative. `(_size+length)` will now be negative, and the check on line 296 will not be triggered. Furthermore, `MetaDataBuilder.checkSize` allows for user-entered HPACK header value sizes to be negative, potentia
Debian
CVE-2023-36478: jetty9 - Eclipse Jetty provides a web server and servlet container. In versions 11.0.0 th...
vendor_debian·2023·CVSS 7.5
CVE-2023-36478 [HIGH] CVE-2023-36478: jetty9 - Eclipse Jetty provides a web server and servlet container. In versions 11.0.0 th...
Eclipse Jetty provides a web server and servlet container. In versions 11.0.0 through 11.0.15, 10.0.0 through 10.0.15, and 9.0.0 through 9.4.52, an integer overflow in `MetaDataBuilder.checkSize` allows for HTTP/2 HPACK header values to exceed their size limit. `MetaDataBuilder.java` determines if a header name or value exceeds the size limit, and throws an exception if the limit is exceeded. However, when length is very large and huffman is true, the multiplication by 4 in line 295 will overflow, and length will become negative. `(_size+length)` will now be negative, and the check on line 296 will not be triggered. Furthermore, `MetaDataBuilder.checkSize` allows for user-entered HPACK header value sizes to be negative, potentially leading to a very large buffer allocation later on when th
OSV
HTTP/2 HPACK integer overflow and buffer allocation
osv·2023-10-10
CVE-2023-36478 [HIGH] HTTP/2 HPACK integer overflow and buffer allocation
HTTP/2 HPACK integer overflow and buffer allocation
An integer overflow in `MetaDataBuilder.checkSize` allows for HTTP/2 HPACK header values to
exceed their size limit.
In `MetaDataBuilder.java`, the following code determines if a header name or value
exceeds the size limit, and throws an exception if the limit is exceeded:
```java
291 public void checkSize(int length, boolean huffman) throws SessionException
292 {
293 // Apply a huffman fudge factor
294 if (huffman)
295 length = (length * 4) / 3;
296 if ((_size + length) > _maxSize)
297 throw new HpackException.SessionException("Header too large %d > %d",
_size + length, _maxSize);
298 }
```
However, when length is very large and huffman is true, the multiplication by 4 in line 295
will overflow, and length will become negative. (_siz
OSV
CVE-2023-36478: Eclipse Jetty provides a web server and servlet container
osv·2023-10-10·CVSS 7.5
CVE-2023-36478 [HIGH] CVE-2023-36478: Eclipse Jetty provides a web server and servlet container
Eclipse Jetty provides a web server and servlet container. In versions 11.0.0 through 11.0.15, 10.0.0 through 10.0.15, and 9.0.0 through 9.4.52, an integer overflow in `MetaDataBuilder.checkSize` allows for HTTP/2 HPACK header values to exceed their size limit. `MetaDataBuilder.java` determines if a header name or value exceeds the size limit, and throws an exception if the limit is exceeded. However, when length is very large and huffman is true, the multiplication by 4 in line 295 will overflow, and length will become negative. `(_size+length)` will now be negative, and the check on line 296 will not be triggered. Furthermore, `MetaDataBuilder.checkSize` allows for user-entered HPACK header value sizes to be negative, potentially leading to a very large buffer allocation later on when th
GHSA
HTTP/2 HPACK integer overflow and buffer allocation
ghsa·2023-10-10
CVE-2023-36478 [HIGH] CWE-190 HTTP/2 HPACK integer overflow and buffer allocation
HTTP/2 HPACK integer overflow and buffer allocation
An integer overflow in `MetaDataBuilder.checkSize` allows for HTTP/2 HPACK header values to
exceed their size limit.
In `MetaDataBuilder.java`, the following code determines if a header name or value
exceeds the size limit, and throws an exception if the limit is exceeded:
```java
291 public void checkSize(int length, boolean huffman) throws SessionException
292 {
293 // Apply a huffman fudge factor
294 if (huffman)
295 length = (length * 4) / 3;
296 if ((_size + length) > _maxSize)
297 throw new HpackException.SessionException("Header too large %d > %d",
_size + length, _maxSize);
298 }
```
However, when length is very large and huffman is true, the multiplication by 4 in line 295
will overflow, and length will become negative. (_siz
No detection rules found.
No public exploits indexed.
Trailofbits
Securing open-source infrastructure with OSTIF
blogs_trailofbits·2024-01-09
Securing open-source infrastructure with OSTIF
The Open Source Technology Improvement Fund (OSTIF) counters an often overlooked challenge in the open-source world: the same software projects that uphold today’s internet infrastructure are reliant on, in OSTIF’s words, a “surprisingly small group of people with a limited amount of time” for all development, testing, and maintenance.
This scarcity of contributor time in the open-source community is a well-known problem, and it renders the internet’s critical infrastructure vulnerable. To quote OSTIF, “because of the lack of a profit motive, core open-source projects are woefully underfunded and their resources are lacking. This leaves crucial Internet infrastructure susceptible to bugs, poor documentation, poor performance, slow release schedules, and even espionage.”
We couldn’t agree
Trailofbits
Securing open-source infrastructure with OSTIF
blogs_trailofbits·2024-01-09
Securing open-source infrastructure with OSTIF
The Open Source Technology Improvement Fund (OSTIF) counters an often overlooked challenge in the open-source world: the same software projects that uphold today’s internet infrastructure are reliant on, in OSTIF’s words, a “surprisingly small group of people with a limited amount of time” for all development, testing, and maintenance.
This scarcity of contributor time in the open-source community is a well-known problem, and it renders the internet’s critical infrastructure vulnerable. To quote OSTIF, “because of the lack of a profit motive, core open-source projects are woefully underfunded and their resources are lacking. This leaves crucial Internet infrastructure susceptible to bugs, poor documentation, poor performance, slow release schedules, and even espionage.”
We couldn’t agree
http://www.openwall.com/lists/oss-security/2023/10/18/4https://github.com/eclipse/jetty.project/pull/9634https://github.com/eclipse/jetty.project/releases/tag/jetty-10.0.16https://github.com/eclipse/jetty.project/releases/tag/jetty-11.0.16https://github.com/eclipse/jetty.project/releases/tag/jetty-9.4.53.v20231009https://github.com/eclipse/jetty.project/security/advisories/GHSA-wgh7-54f2-x98rhttps://lists.debian.org/debian-lts-announce/2023/10/msg00045.htmlhttps://security.netapp.com/advisory/ntap-20231116-0011/https://security.netapp.com/advisory/ntap-20240621-0006/https://www.debian.org/security/2023/dsa-5540http://www.openwall.com/lists/oss-security/2023/10/18/4https://github.com/eclipse/jetty.project/pull/9634https://github.com/eclipse/jetty.project/releases/tag/jetty-10.0.16https://github.com/eclipse/jetty.project/releases/tag/jetty-11.0.16https://github.com/eclipse/jetty.project/releases/tag/jetty-9.4.53.v20231009https://github.com/eclipse/jetty.project/security/advisories/GHSA-wgh7-54f2-x98rhttps://lists.debian.org/debian-lts-announce/2023/10/msg00045.htmlhttps://security.netapp.com/advisory/ntap-20231116-0011/https://security.netapp.com/advisory/ntap-20240621-0006/https://www.debian.org/security/2023/dsa-5540
2023-10-10
Published