J
etty is a Java based web server and servlet engine. An HTTP/2 SSL connection that is established and TCP congested will be leaked when it times out. An attacker can cause many connections to end up in this state, and the server may run out of file descriptors, eventually causing the server to stop accepting new connections from valid clients. The vulnerability is patched in 9.4.54, 10.0.20, 11.0.20, and 12.0.6.
References
| Link | Resource |
|---|---|
| http://www.openwall.com/lists/oss-security/2024/03/20/2 | Mailing List Third Party Advisory |
| https://github.com/jetty/jetty.project/issues/11256 | Issue Tracking |
| https://github.com/jetty/jetty.project/security/advisories/GHSA-rggv-cv7r-mw98 | Vendor Advisory |
| https://lists.debian.org/debian-lts-announce/2024/04/msg00002.html | Mailing List |
| https://security.netapp.com/advisory/ntap-20240329-0001/ | Third Party Advisory |
| http://www.openwall.com/lists/oss-security/2024/03/20/2 | Mailing List Third Party Advisory |
| https://github.com/jetty/jetty.project/issues/11256 | Issue Tracking |
| https://github.com/jetty/jetty.project/security/advisories/GHSA-rggv-cv7r-mw98 | Vendor Advisory |
| https://lists.debian.org/debian-lts-announce/2024/04/msg00002.html | Mailing List |
| https://security.netapp.com/advisory/ntap-20240329-0001/ | Third Party Advisory |
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
History
13 Feb 2025, 18:16
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | (en) Jetty is a Java based web server and servlet engine. An HTTP/2 SSL connection that is established and TCP congested will be leaked when it times out. An attacker can cause many connections to end up in this state, and the server may run out of file descriptors, eventually causing the server to stop accepting new connections from valid clients. The vulnerability is patched in 9.4.54, 10.0.20, 11.0.20, and 12.0.6. |
07 Feb 2025, 17:36
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Netapp active Iq Unified Manager
Debian Debian debian Linux Eclipse jetty Netapp bluexp Eclipse Netapp |
|
| CWE | CWE-770 | |
| CPE | cpe:2.3:a:netapp:bluexp:-:*:*:*:*:*:*:* cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:* cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:* cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* |
|
| References | () http://www.openwall.com/lists/oss-security/2024/03/20/2 - Mailing List, Third Party Advisory | |
| References | () https://github.com/jetty/jetty.project/issues/11256 - Issue Tracking | |
| References | () https://github.com/jetty/jetty.project/security/advisories/GHSA-rggv-cv7r-mw98 - Vendor Advisory | |
| References | () https://lists.debian.org/debian-lts-announce/2024/04/msg00002.html - Mailing List | |
| References | () https://security.netapp.com/advisory/ntap-20240329-0001/ - Third Party Advisory |
21 Nov 2024, 08:55
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://www.openwall.com/lists/oss-security/2024/03/20/2 - | |
| References | () https://github.com/jetty/jetty.project/issues/11256 - | |
| References | () https://github.com/jetty/jetty.project/security/advisories/GHSA-rggv-cv7r-mw98 - | |
| References | () https://lists.debian.org/debian-lts-announce/2024/04/msg00002.html - | |
| References | () https://security.netapp.com/advisory/ntap-20240329-0001/ - |
01 May 2024, 18:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Information
Published : 2024-02-26 16:27
Updated : 2025-02-13 18:16
NVD link : CVE-2024-22201
Mitre link : CVE-2024-22201
CVE.ORG link : CVE-2024-22201
JSON object : View
Products Affected