Vulnerability Description
In Eclipse Jetty HTTP/2 server implementation, when encountering an invalid HTTP/2 request, the error handling has a bug that can wind up not properly cleaning up the active connections and associated resources. This can lead to a Denial of Service scenario where there are no enough resources left to process good requests.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Eclipse | Jetty | < 9.4.47 |
| Debian | Debian Linux | 10.0 |
| Netapp | Element Plug-In For Vcenter Server | - |
| Netapp | Management Services For Element Software And Netapp Hci | - |
| Netapp | Snapcenter | - |
| Netapp | Solidfire \& Hci Storage Node | - |
| Netapp | Hci Compute Node | - |
| Jenkins | Jenkins | < 2.263 |
Related Weaknesses (CWE)
References
- http://www.openwall.com/lists/oss-security/2022/09/09/2Mailing ListThird Party Advisory
- https://github.com/eclipse/jetty.project/security/advisories/GHSA-wgmr-mf83-7x4jThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2022/08/msg00011.htmlMailing ListThird Party Advisory
- https://security.netapp.com/advisory/ntap-20220901-0006/Third Party Advisory
- https://www.debian.org/security/2022/dsa-5198Third Party Advisory
- http://www.openwall.com/lists/oss-security/2022/09/09/2Mailing ListThird Party Advisory
- https://github.com/eclipse/jetty.project/security/advisories/GHSA-wgmr-mf83-7x4jThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2022/08/msg00011.htmlMailing ListThird Party Advisory
- https://security.netapp.com/advisory/ntap-20220901-0006/Third Party Advisory
- https://www.debian.org/security/2022/dsa-5198Third Party Advisory
FAQ
What is CVE-2022-2048?
CVE-2022-2048 is a vulnerability with a CVSS score of 7.5 (HIGH). In Eclipse Jetty HTTP/2 server implementation, when encountering an invalid HTTP/2 request, the error handling has a bug that can wind up not properly cleaning up the active connections and associated...
How severe is CVE-2022-2048?
CVE-2022-2048 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-2048?
Check the references section above for vendor advisories and patch information. Affected products include: Eclipse Jetty, Debian Debian Linux, Netapp Element Plug-In For Vcenter Server, Netapp Management Services For Element Software And Netapp Hci, Netapp Snapcenter.