CVE-2018-12545

In Eclipse Jetty version 9.3.x and 9.4.x, the server is vulnerable to Denial of Service conditions if a remote client sends either large SETTINGs fram...

原文の説明

取得元が公開している説明をそのまま載せています (多くは英語)。

In Eclipse Jetty version 9.3.x and 9.4.x, the server is vulnerable to Denial of Service conditions if a remote client sends either large SETTINGs frames container containing many settings, or many small SETTINGs frames. The vulnerability is due to the additional CPU and memory allocations required to handle changed settings.

出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV

参照URL

advisory oracle.com
patch oracle.com
report bugs.eclipse.org
web lists.apache.org
web lists.apache.org
web lists.apache.org
web lists.apache.org
web lists.apache.org
web lists.fedoraproject.org