Vulnerability · Published Jul 7, 2022 · Assigned by eclipse
CVE-2022-2191
High 7.5
In plain English
A high-severity security flaw in Eclipse Jetty from The Eclipse Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.2% (higher than 82% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)2.2%top 17.6% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
In Eclipse Jetty versions 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, SslConnection does not release ByteBuffers from configured ByteBufferPool in case of error code paths.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.eclipse.jetty:jetty-server | 10.0.10 | GHSA-8mpp-f3f7-xc28 |
| Maven | org.eclipse.jetty:jetty-server | 11.0.10 | GHSA-8mpp-f3f7-xc28 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| The Eclipse Foundation | Eclipse Jetty | 10.0.0 – before unspecifiedunspecified – through 10.0.911.0.0 – before unspecifiedunspecified – through 11.0.9 |
Weakness: CWE-404, CWE-664 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- https://github.com/eclipse/jetty.project/security/advisories/GHSA-8mpp-f3f7-xc28 x_refsource_CONFIRM
- https://security.netapp.com/advisory/ntap-20220909-0003/ x_refsource_CONFIRM