CVE-2024-8184 (Medium) detected in jetty-server-10.0.16.jar

[mend-for-github-com[bot]]

CVE-2024-8184 - Medium Severity Vulnerability

Vulnerable Library - jetty-server-10.0.16.jar

The core jetty server artifact.

Library home page: https://webtide.com

Path to dependency file: /build.gradle

Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.eclipse.jetty/jetty-server/10.0.16/fefaa98e95b9737562d196d24f7846734ce99e17/jetty-server-10.0.16.jar

Dependency Hierarchy:

• jenkins-test-harness-2085.va_c531db_287b_d.jar (Root Library)
  • jetty-security-10.0.16.jar
    • :x: jetty-server-10.0.16.jar (Vulnerable Library)

Found in HEAD commit: c9934b385037128b6444abf6cd7fccd3a7405c2b

Found in base branch: main

Vulnerability Details

There exists a security vulnerability in Jetty's ThreadLimitHandler.getRemote() which can be exploited by unauthorized users to cause remote denial-of-service (DoS) attack. By repeatedly sending crafted requests, attackers can trigger OutofMemory errors and exhaust the server's memory.

Publish Date: 2024-10-14

URL: CVE-2024-8184

CVSS 3 Score Details (5.9)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://github.com/jetty/jetty.project/security/advisories/GHSA-g8m5-722r-8whq

Release Date: 2024-10-14

Fix Resolution: org.eclipse.jetty:jetty-server:9.4.56,10.0.24,11.0.24,12.0.9, org.eclipse.jetty.ee9:jetty-ee9-nested:9.4.56,10.0.24,11.0.24,12.0.9