PT-2023-25586 · Eclipse+6 · Eclipse Jetty+8

Jmcc0Nn3Ll + 3 · Publicado 2023-10-10 · Atualizado 2025-09-29 · CVE-2023-36478

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Eclipse Jetty versions 9.0.0 through 9.4.52 Eclipse Jetty versions 10.0.0 through 10.0.15 Eclipse Jetty versions 11.0.0 through 11.0.15

Description The issue is caused by an integer overflow in MetaDataBuilder.checkSize, allowing HTTP/2 HPACK header values to exceed their size limit. When the length is very large and huffman is true, the multiplication by 4 will overflow, and the length will become negative. This can lead to a very large buffer allocation later on when the user-entered size is multiplied by 2. Users of HTTP/2 can be impacted by a remote denial of service attack.

Recommendations For Eclipse Jetty versions 9.0.0 through 9.4.52, upgrade to version 9.4.53 or later. For Eclipse Jetty versions 10.0.0 through 10.0.15, upgrade to version 10.0.16 or later. For Eclipse Jetty versions 11.0.0 through 11.0.15, upgrade to version 11.0.16 or later.

Exploit

Correção

DoS

Integer Overflow

Resource Exhaustion

Enumeração de Fraquezas

CWE-190

CWE-400

Identificadores relacionados

ALSA-2025_16880

ALT-PU-2024-16002

ALT-PU-2024-16022

ALT-PU-2024-16072

BIT-JENKINS-2023-36478

CVE-2023-36478

DLA-3641-1

DSA-5540-1

GHSA-WGH7-54F2-X98R

OPENSUSE-SU-2023_4210-1

OPENSUSE-SU-2024:13329-1

SUSE-SU-2023:4210-1

Produtos afetados

Alt Linux

Astra Linux

Bamboo

Bitbucket

Confluence

Eclipse Jetty

Jenkins

Red Os

Suse

Referências · 47

• 🔥 https://github.com/eclipse/jetty.project/security/advisories/GHSA-wgh7-54f2-x98r · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/36xxx/CVE-2023-36478.json · Exploit
• https://github.com/eclipse/jetty.project/pull/9634 · Correção
• https://github.com/eclipse/jetty.project/releases/tag/jetty-10.0.16 · Nota
• https://github.com/eclipse/jetty.project/releases/tag/jetty-9.4.53.v20231009 · Nota
• https://github.com/eclipse/jetty.project/releases/tag/jetty-11.0.16 · Nota
• https://github.com/jetty/jetty.project/security/advisories/GHSA-wgh7-54f2-x98r · Nota
• https://github.com/eclipse/jetty.project · Nota
• https://security.netapp.com/advisory/ntap-20231116-0011 · Nota
• https://safe-surf.ru/specialists/bulletins-nkcki/703452 · Nota de Segurança
• https://jira.atlassian.com/browse/BAM-25623 · Nota
• https://suse.com/security/cve/CVE-2023-36478 · Nota
• https://ubuntu.com/security/CVE-2023-36478 · Aviso do Fabricante
• https://bugzilla.suse.com/1215415 · Nota
• https://security-tracker.debian.org/tracker/CVE-2023-36478 · Aviso do Fabricante