CVE-2022-2048

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-2048
In Eclipse Jetty HTTP/2 server implementation, when encountering an invalid HTTP/2 request, the error handling has a bug that can wind up not properly cleaning up the active connections and associated resources. This can lead to a Denial of Service scenario where there are no enough resources left to process good requests.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

5.0 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:N/C:N/I:N/A:P

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References
Link Resource
http://www.openwall.com/lists/oss-security/2022/09/09/2 Mailing List Third Party Advisory
https://github.com/eclipse/jetty.project/security/advisories/GHSA-wgmr-mf83-7x4j Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/08/msg00011.html Mailing List Third Party Advisory
https://security.netapp.com/advisory/ntap-20220901-0006/ Third Party Advisory
https://www.debian.org/security/2022/dsa-5198 Third Party Advisory
http://www.openwall.com/lists/oss-security/2022/09/09/2 Mailing List Third Party Advisory
https://github.com/eclipse/jetty.project/security/advisories/GHSA-wgmr-mf83-7x4j Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/08/msg00011.html Mailing List Third Party Advisory
https://security.netapp.com/advisory/ntap-20220901-0006/ Third Party Advisory
https://www.debian.org/security/2022/dsa-5198 Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*
cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*
cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*

Configuration 3 (hide)

OR cpe:2.3:a:netapp:element_plug-in_for_vcenter_server:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:management_services_for_element_software_and_netapp_hci:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:solidfire_\&_hci_storage_node:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:*

Configuration 4 (hide)

OR cpe:2.3:a:jenkins:jenkins:*:*:*:*:*:*:*:*
cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:*
History

21 Nov 2024, 07:00

Type Values Removed Values Added
References () http://www.openwall.com/lists/oss-security/2022/09/09/2 - Mailing List, Third Party Advisory () http://www.openwall.com/lists/oss-security/2022/09/09/2 - Mailing List, Third Party Advisory
References () https://github.com/eclipse/jetty.project/security/advisories/GHSA-wgmr-mf83-7x4j - Third Party Advisory () https://github.com/eclipse/jetty.project/security/advisories/GHSA-wgmr-mf83-7x4j - Third Party Advisory
References () https://lists.debian.org/debian-lts-announce/2022/08/msg00011.html - Mailing List, Third Party Advisory () https://lists.debian.org/debian-lts-announce/2022/08/msg00011.html - Mailing List, Third Party Advisory
References () https://security.netapp.com/advisory/ntap-20220901-0006/ - Third Party Advisory () https://security.netapp.com/advisory/ntap-20220901-0006/ - Third Party Advisory
References () https://www.debian.org/security/2022/dsa-5198 - Third Party Advisory () https://www.debian.org/security/2022/dsa-5198 - Third Party Advisory

24 Jul 2023, 13:16

Type Values Removed Values Added
CWE CWE-400 NVD-CWE-Other
References (MLIST) http://www.openwall.com/lists/oss-security/2022/09/09/2 - Third Party Advisory (MLIST) http://www.openwall.com/lists/oss-security/2022/09/09/2 - Mailing List, Third Party Advisory

25 Oct 2022, 19:30

Type Values Removed Values Added
CPE cpe:2.3:a:netapp:solidfire_\&_hci_storage_node:-:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
cpe:2.3:a:jenkins:jenkins:*:*:*:*:*:*:*:*
cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:a:netapp:element_plug-in_for_vcenter_server:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:management_services_for_element_software_and_netapp_hci:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:*
References (MLIST) http://www.openwall.com/lists/oss-security/2022/09/09/2 - (MLIST) http://www.openwall.com/lists/oss-security/2022/09/09/2 - Third Party Advisory
References (DEBIAN) https://www.debian.org/security/2022/dsa-5198 - (DEBIAN) https://www.debian.org/security/2022/dsa-5198 - Third Party Advisory
References (MLIST) https://lists.debian.org/debian-lts-announce/2022/08/msg00011.html - (MLIST) https://lists.debian.org/debian-lts-announce/2022/08/msg00011.html - Mailing List, Third Party Advisory
References (CONFIRM) https://security.netapp.com/advisory/ntap-20220901-0006/ - (CONFIRM) https://security.netapp.com/advisory/ntap-20220901-0006/ - Third Party Advisory

09 Sep 2022, 15:15

Type Values Removed Values Added
References
  • (MLIST) http://www.openwall.com/lists/oss-security/2022/09/09/2 -

01 Sep 2022, 14:15

Type Values Removed Values Added
References
  • (CONFIRM) https://security.netapp.com/advisory/ntap-20220901-0006/ -

22 Aug 2022, 01:15

Type Values Removed Values Added
References
  • (MLIST) https://lists.debian.org/debian-lts-announce/2022/08/msg00011.html -

02 Aug 2022, 20:15

Type Values Removed Values Added
References
  • (DEBIAN) https://www.debian.org/security/2022/dsa-5198 -

15 Jul 2022, 15:35

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : 5.0
v3 : 7.5
References (CONFIRM) https://github.com/eclipse/jetty.project/security/advisories/GHSA-wgmr-mf83-7x4j - (CONFIRM) https://github.com/eclipse/jetty.project/security/advisories/GHSA-wgmr-mf83-7x4j - Third Party Advisory
CPE cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*
CWE CWE-400

07 Jul 2022, 21:15

Type Values Removed Values Added
New CVE
Information

Published : 2022-07-07 21:15

Updated : 2024-11-21 07:00

NVD link : CVE-2022-2048

Mitre link : CVE-2022-2048

CVE.ORG link : CVE-2022-2048

JSON object : View

Products Affected

jenkins

  • jenkins

netapp

  • snapcenter
  • hci_compute_node
  • element_plug-in_for_vcenter_server
  • management_services_for_element_software_and_netapp_hci
  • solidfire_\&_hci_storage_node

debian

  • debian_linux

eclipse

  • jetty
CWE
CWE-410

Insufficient Resource Pool

CWE-664

Improper Control of a Resource Through its Lifetime

NVD-CWE-Other