swagger-api / swagger-api/swagger-codegen
CVE-2021-28165 (High) detected in jetty-io-9.2.28.v20190418.jar
Nobody has claimed this yet.
- Dominant language
- Mustache
- Stars
- 17.8k
- Forks
- 6k
- PR merge metrics
- No merged PRs in 30d
Description
CVE-2021-28165 - High Severity Vulnerability
Vulnerable Library - jetty-io-9.2.28.v20190418.jar
Administrative parent pom for Jetty modules
Library home page: http://www.eclipse.org/jetty
Path to vulnerable library: /target/lib/jetty-io-9.2.28.v20190418.jar
Dependency Hierarchy:
- ❌ jetty-io-9.2.28.v20190418.jar (Vulnerable Library)
Found in HEAD commit: 4b7a8d7d7384aa6a27d6309c35ade0916edae7ed
Found in base branch: 3.0.0
Vulnerability Details
In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invalid TLS frame.
Publish Date: 2021-04-01
URL: CVE-2021-28165
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://github.com/eclipse/jetty.project/security/advisories/GHSA-26vr-8j45-3r4w
Release Date: 2021-04-01
Fix Resolution: 9.4.39.v20210325
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Locate the dependency declaration that produces /target/lib/jetty-io-9.2.28.v20190418.jar, using the administrative parent pom context in the issue. Review the Jetty security advisory and update the dependency to the stated fixed version, 9.4.39.v20210325. Run the project's dependency or vulnerability scan to confirm CVE-2021-28165 is no longer detected.
Written by the indexing model from the issue text.
Assessment
- Domain
- security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100