中危 Eclipse Jetty 资源管理错误漏洞

CVE编号

CVE-2021-28165

利用情况

暂无

补丁情况

官方补丁

披露时间

2021-04-02
漏洞描述
Eclipse Jetty是Eclipse基金会的一个开源的、基于Java的Web服务器和Java Servlet容器。

Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1 存在安全漏洞,该漏洞源于接收到较大的无效TLS帧后的异常处理,CPU使用率可以达到100%。目前没有详细的漏洞细节提供。
解决建议
厂商已发布了漏洞修复程序,请及时关注更新:
https://github.com/eclipse/jetty.project/security/advisories/GHSA-26vr-8j45-3r4w
参考链接
http://www.openwall.com/lists/oss-security/2021/04/20/3
https://github.com/eclipse/jetty.project/security/advisories/GHSA-26vr-8j45-3r4w
https://lists.apache.org/thread.html/r002258611ed0c35b82b839d284b43db9dcdec12...
https://lists.apache.org/thread.html/r002258611ed0c35b82b839d284b43db9dcdec12...
https://lists.apache.org/thread.html/r03ca0b69db1e3e5f72fe484b71370d537cd711c...
https://lists.apache.org/thread.html/r03ca0b69db1e3e5f72fe484b71370d537cd711c...
https://lists.apache.org/thread.html/r05db8e0ef01e1280cc7543575ae0fa1c2b4d06a...
https://lists.apache.org/thread.html/r05db8e0ef01e1280cc7543575ae0fa1c2b4d06a...
https://lists.apache.org/thread.html/r06d54a297cb8217c66e5190912a955fb870ba47...
https://lists.apache.org/thread.html/r06d54a297cb8217c66e5190912a955fb870ba47...
https://lists.apache.org/thread.html/r077b76cafb61520c14c87c4fc76419ed664002d...
https://lists.apache.org/thread.html/r077b76cafb61520c14c87c4fc76419ed664002d...
https://lists.apache.org/thread.html/r0841b06b48324cfc81325de3c05a92e53f99718...
https://lists.apache.org/thread.html/r0841b06b48324cfc81325de3c05a92e53f99718...
https://lists.apache.org/thread.html/r0a241b0649beef90d422b42a26a2470d336e59e...
https://lists.apache.org/thread.html/r0a241b0649beef90d422b42a26a2470d336e59e...
https://lists.apache.org/thread.html/r0a4797ba6ceea8074f47574a4f3cc11493d514c...
https://lists.apache.org/thread.html/r0a4797ba6ceea8074f47574a4f3cc11493d514c...
https://lists.apache.org/thread.html/r0bf3aa065abd23960fc8bdc8090d6bc00d5e391...
https://lists.apache.org/thread.html/r0bf3aa065abd23960fc8bdc8090d6bc00d5e391...
https://lists.apache.org/thread.html/r0cd1a5e3f4ad4770b44f8aa96572fc09d5b35be...
https://lists.apache.org/thread.html/r0cd1a5e3f4ad4770b44f8aa96572fc09d5b35be...
https://lists.apache.org/thread.html/r0f02034a33076fd7243cf3a8807d2766e373f5c...
https://lists.apache.org/thread.html/r0f02034a33076fd7243cf3a8807d2766e373f5c...
https://lists.apache.org/thread.html/r111f1ce28b133a8090ca4f809a1bdf18a777426...
https://lists.apache.org/thread.html/r111f1ce28b133a8090ca4f809a1bdf18a777426...
https://lists.apache.org/thread.html/r17e26cf9a1e3cbc09522d15ece5d7c7a00cdced...
https://lists.apache.org/thread.html/r17e26cf9a1e3cbc09522d15ece5d7c7a00cdced...
https://lists.apache.org/thread.html/r23785214d47673b811ef119ca3a40f729801865...
https://lists.apache.org/thread.html/r23785214d47673b811ef119ca3a40f729801865...
https://lists.apache.org/thread.html/r2afc72af069a7fe89ca2de847f3ab3971cb1d66...
https://lists.apache.org/thread.html/r2afc72af069a7fe89ca2de847f3ab3971cb1d66...
https://lists.apache.org/thread.html/r2ea2f0541121f17e470a0184843720046c59d4b...
https://lists.apache.org/thread.html/r2ea2f0541121f17e470a0184843720046c59d4b...
https://lists.apache.org/thread.html/r2f2d9c3b7cc750a6763d6388bcf5db0c7b467bd...
https://lists.apache.org/thread.html/r2f2d9c3b7cc750a6763d6388bcf5db0c7b467bd...
https://lists.apache.org/thread.html/r31f591a0deac927ede8ccc3eac4bb92697ee236...
https://lists.apache.org/thread.html/r31f591a0deac927ede8ccc3eac4bb92697ee236...
https://lists.apache.org/thread.html/r33eb3889ca0aa12720355e64fc2f8f1e8c0c28a...
https://lists.apache.org/thread.html/r33eb3889ca0aa12720355e64fc2f8f1e8c0c28a...
https://lists.apache.org/thread.html/r40136c2010fccf4fb2818a965e5d7ecca470e5f...
https://lists.apache.org/thread.html/r40136c2010fccf4fb2818a965e5d7ecca470e5f...
https://lists.apache.org/thread.html/r401b1c592f295b811608010a70792b11c91885b...
https://lists.apache.org/thread.html/r401b1c592f295b811608010a70792b11c91885b...
https://lists.apache.org/thread.html/r411d75dc6bcefadaaea246549dd18e8d391a880...
https://lists.apache.org/thread.html/r411d75dc6bcefadaaea246549dd18e8d391a880...
https://lists.apache.org/thread.html/r47a7542ab61da865fff3db0fe74bfe76c89a37b...
https://lists.apache.org/thread.html/r47a7542ab61da865fff3db0fe74bfe76c89a37b...
https://lists.apache.org/thread.html/r4891d45625cc522fe0eb764ac50d48bcca9c0db...
https://lists.apache.org/thread.html/r4891d45625cc522fe0eb764ac50d48bcca9c0db...
https://lists.apache.org/thread.html/r4a66bfbf62281e31bc1345ebecbfd96f35199ee...
https://lists.apache.org/thread.html/r4a66bfbf62281e31bc1345ebecbfd96f35199ee...
https://lists.apache.org/thread.html/r4abbd760d24bab2b8f1294c5c9216ae91510009...
https://lists.apache.org/thread.html/r4abbd760d24bab2b8f1294c5c9216ae91510009...
https://lists.apache.org/thread.html/r4b1fef117bccc7f5fd4c45fd2cabc26838df823...
https://lists.apache.org/thread.html/r4b1fef117bccc7f5fd4c45fd2cabc26838df823...
https://lists.apache.org/thread.html/r520c56519b8820955a86966f499e7a0afcbcf66...
https://lists.apache.org/thread.html/r520c56519b8820955a86966f499e7a0afcbcf66...
https://lists.apache.org/thread.html/r56e5568ac73daedcb3b5affbb4b908999f03d3c...
https://lists.apache.org/thread.html/r56e5568ac73daedcb3b5affbb4b908999f03d3c...
https://lists.apache.org/thread.html/r5b3693da7ecb8a75c0e930b4ca26a5f97aa0207...
https://lists.apache.org/thread.html/r5b3693da7ecb8a75c0e930b4ca26a5f97aa0207...
https://lists.apache.org/thread.html/r5d1f16dca2e010193840068f1a1ec17b7015e91...
https://lists.apache.org/thread.html/r5d1f16dca2e010193840068f1a1ec17b7015e91...
https://lists.apache.org/thread.html/r5f172f2dd8fb02f032ef4437218fd4f610605a3...
https://lists.apache.org/thread.html/r5f172f2dd8fb02f032ef4437218fd4f610605a3...
https://lists.apache.org/thread.html/r64ff94118f6c80e6c085c6e2d51bbb490eaefad...
https://lists.apache.org/thread.html/r64ff94118f6c80e6c085c6e2d51bbb490eaefad...
https://lists.apache.org/thread.html/r6535b2beddf0ed2d263ab64ff365a5f790df135...
https://lists.apache.org/thread.html/r6535b2beddf0ed2d263ab64ff365a5f790df135...
https://lists.apache.org/thread.html/r65daad30d13f7c56eb5c3d7733ad8dddbf62c46...
https://lists.apache.org/thread.html/r65daad30d13f7c56eb5c3d7733ad8dddbf62c46...
https://lists.apache.org/thread.html/r694e57d74fcaa48818a03c282aecfa13ae68340...
https://lists.apache.org/thread.html/r694e57d74fcaa48818a03c282aecfa13ae68340...
https://lists.apache.org/thread.html/r6ac9e263129328c0db9940d72b4a6062e703c58...
https://lists.apache.org/thread.html/r6ac9e263129328c0db9940d72b4a6062e703c58...
https://lists.apache.org/thread.html/r6b070441871a4e6ce8bb63e190c879bb60da7c5...
https://lists.apache.org/thread.html/r6b070441871a4e6ce8bb63e190c879bb60da7c5...
https://lists.apache.org/thread.html/r6ce2907b2691c025250ba010bc797677ef78d59...
https://lists.apache.org/thread.html/r6ce2907b2691c025250ba010bc797677ef78d59...
https://lists.apache.org/thread.html/r6f256a1d15505f79f4050a69bb8f27b34cb3536...
https://lists.apache.org/thread.html/r6f256a1d15505f79f4050a69bb8f27b34cb3536...
https://lists.apache.org/thread.html/r71031d0acb1de55c9ab32f4750c50ce2f285432...
https://lists.apache.org/thread.html/r71031d0acb1de55c9ab32f4750c50ce2f285432...
https://lists.apache.org/thread.html/r7189bf41cb0c483629917a01cf296f9fbdbda39...
https://lists.apache.org/thread.html/r7189bf41cb0c483629917a01cf296f9fbdbda39...
https://lists.apache.org/thread.html/r72bf813ed4737196ea3ed26494e949577be587f...
https://lists.apache.org/thread.html/r72bf813ed4737196ea3ed26494e949577be587f...
https://lists.apache.org/thread.html/r746434be6abff9ad321ff54ecae09e1f09c1c7c...
https://lists.apache.org/thread.html/r746434be6abff9ad321ff54ecae09e1f09c1c7c...
https://lists.apache.org/thread.html/r769155244ca2da2948a44091bb3bb9a56e7e1c7...
https://lists.apache.org/thread.html/r769155244ca2da2948a44091bb3bb9a56e7e1c7...
https://lists.apache.org/thread.html/r780c3c210a05c5bf7b4671303f46afc3fe56758...
https://lists.apache.org/thread.html/r780c3c210a05c5bf7b4671303f46afc3fe56758...
https://lists.apache.org/thread.html/r7bf7004c18c914fae3d5a6a0191d477e5b6408d...
https://lists.apache.org/thread.html/r7bf7004c18c914fae3d5a6a0191d477e5b6408d...
https://lists.apache.org/thread.html/r7c40fb3a66a39b6e6c83b0454bc6917ffe6c69e...
https://lists.apache.org/thread.html/r7c40fb3a66a39b6e6c83b0454bc6917ffe6c69e...
https://lists.apache.org/thread.html/r81748d56923882543f5be456043c67daef84d63...
https://lists.apache.org/thread.html/r81748d56923882543f5be456043c67daef84d63...
https://lists.apache.org/thread.html/r83453ec252af729996476e5839d0b28f0729495...
https://lists.apache.org/thread.html/r83453ec252af729996476e5839d0b28f0729495...
https://lists.apache.org/thread.html/r90327f55db8f1d079f9a724aabf1f5eb3c00c1d...
https://lists.apache.org/thread.html/r90327f55db8f1d079f9a724aabf1f5eb3c00c1d...
https://lists.apache.org/thread.html/r940f15db77a96f6aea92d830bc94d8d95f26cc5...
https://lists.apache.org/thread.html/r940f15db77a96f6aea92d830bc94d8d95f26cc5...
https://lists.apache.org/thread.html/r942f4a903d0abb25ac75c592e57df98dea51350...
https://lists.apache.org/thread.html/r942f4a903d0abb25ac75c592e57df98dea51350...
https://lists.apache.org/thread.html/r9974f64723875052e02787b2a5eda689ac5247c...
https://lists.apache.org/thread.html/r9974f64723875052e02787b2a5eda689ac5247c...
https://lists.apache.org/thread.html/r9b793db9f395b546e66fb9c44fe1cd75c775502...
https://lists.apache.org/thread.html/r9b793db9f395b546e66fb9c44fe1cd75c775502...
https://lists.apache.org/thread.html/r9db72e9c33b93eba45a214af588f1d553839b5c...
https://lists.apache.org/thread.html/r9db72e9c33b93eba45a214af588f1d553839b5c...
https://lists.apache.org/thread.html/r9fae5a4087d9ed1c9d4f0c7493b6981a4741cfb...
https://lists.apache.org/thread.html/r9fae5a4087d9ed1c9d4f0c7493b6981a4741cfb...
https://lists.apache.org/thread.html/ra210e38ae0bf615084390b26ba01bb5d66c0a76...
https://lists.apache.org/thread.html/ra210e38ae0bf615084390b26ba01bb5d66c0a76...
https://lists.apache.org/thread.html/ra21b3e6bd9669377139fe33fb46edf6fece3f31...
https://lists.apache.org/thread.html/ra21b3e6bd9669377139fe33fb46edf6fece3f31...
https://lists.apache.org/thread.html/ra50519652b0b7f869a14fbfb4be9758a29171d7...
https://lists.apache.org/thread.html/ra50519652b0b7f869a14fbfb4be9758a29171d7...
https://lists.apache.org/thread.html/ra9dd15ba8a4fb7e42c7fe948a6d6b3868fd6bbf...
https://lists.apache.org/thread.html/ra9dd15ba8a4fb7e42c7fe948a6d6b3868fd6bbf...
https://lists.apache.org/thread.html/rae8bbc5a516f3e21b8a55e61ff6ad0ced03bdbd...
https://lists.apache.org/thread.html/rae8bbc5a516f3e21b8a55e61ff6ad0ced03bdbd...
https://lists.apache.org/thread.html/raea6e820644e8c5a577f77d4e2044f8ab52183c...
https://lists.apache.org/thread.html/raea6e820644e8c5a577f77d4e2044f8ab52183c...
https://lists.apache.org/thread.html/rb00345f6b1620b553d2cc1acaf3017aa75cea37...
https://lists.apache.org/thread.html/rb00345f6b1620b553d2cc1acaf3017aa75cea37...
https://lists.apache.org/thread.html/rb11a13e623218c70b9f2a2d0d122fdaaf905e04...
https://lists.apache.org/thread.html/rb11a13e623218c70b9f2a2d0d122fdaaf905e04...
https://lists.apache.org/thread.html/rb1624b9777a3070135e94331a428c6653a6a1ed...
https://lists.apache.org/thread.html/rb1624b9777a3070135e94331a428c6653a6a1ed...
https://lists.apache.org/thread.html/rb2d34abb67cdf525945fe4b821c5cdbca29a78d...
https://lists.apache.org/thread.html/rb2d34abb67cdf525945fe4b821c5cdbca29a78d...
https://lists.apache.org/thread.html/rb66ed0b4bb74836add60dd5ddf9172016380b2a...
https://lists.apache.org/thread.html/rb66ed0b4bb74836add60dd5ddf9172016380b2a...
https://lists.apache.org/thread.html/rb8f5a6ded384eb00608e6137e87110e7dd7d505...
https://lists.apache.org/thread.html/rb8f5a6ded384eb00608e6137e87110e7dd7d505...
https://lists.apache.org/thread.html/rbab9e67ec97591d063905bc7d4743e6a673f1bc...
https://lists.apache.org/thread.html/rbab9e67ec97591d063905bc7d4743e6a673f1bc...
https://lists.apache.org/thread.html/rbba0b02a3287e34af328070dd58f7828612f96e...
https://lists.apache.org/thread.html/rbba0b02a3287e34af328070dd58f7828612f96e...
https://lists.apache.org/thread.html/rbc075a4ac85e7a8e47420b7383f16ffa0af3b79...
https://lists.apache.org/thread.html/rbc075a4ac85e7a8e47420b7383f16ffa0af3b79...
https://lists.apache.org/thread.html/rbcd7b477df55857bb6cae21fcc4404683ac98aa...
https://lists.apache.org/thread.html/rbcd7b477df55857bb6cae21fcc4404683ac98aa...
https://lists.apache.org/thread.html/rbd9a837a18ca57ac0d9b4165a6eec95ee132f55...
https://lists.apache.org/thread.html/rbd9a837a18ca57ac0d9b4165a6eec95ee132f55...
https://lists.apache.org/thread.html/rc4779abc1cface47e956cf9f8910f15d79c2447...
https://lists.apache.org/thread.html/rc4779abc1cface47e956cf9f8910f15d79c2447...
https://lists.apache.org/thread.html/rc4dbc9907b0bdd634200ac90a15283d9c143c11...
https://lists.apache.org/thread.html/rc4dbc9907b0bdd634200ac90a15283d9c143c11...
https://lists.apache.org/thread.html/rc6c43c3180c0efe00497c73dd374cd34b62036c...
https://lists.apache.org/thread.html/rc6c43c3180c0efe00497c73dd374cd34b62036c...
https://lists.apache.org/thread.html/rc907ed7b089828364437de5ed57fa062330970d...
https://lists.apache.org/thread.html/rc907ed7b089828364437de5ed57fa062330970d...
https://lists.apache.org/thread.html/rcdea97f4d3233298296aabc103c9fcefbf62942...
https://lists.apache.org/thread.html/rcdea97f4d3233298296aabc103c9fcefbf62942...
https://lists.apache.org/thread.html/rd0471252aeb3384c3cfa6d131374646d4641b80...
https://lists.apache.org/thread.html/rd0471252aeb3384c3cfa6d131374646d4641b80...
https://lists.apache.org/thread.html/rd24d8a059233167b4a5aebda4b3534ca1d86caa...
https://lists.apache.org/thread.html/rd24d8a059233167b4a5aebda4b3534ca1d86caa...
https://lists.apache.org/thread.html/rd6c1eb9a8a94b3ac8a525d74d792924e8469f20...
https://lists.apache.org/thread.html/rd6c1eb9a8a94b3ac8a525d74d792924e8469f20...
https://lists.apache.org/thread.html/rd755dfe5f658c42704540ad7950cebd13673908...
https://lists.apache.org/thread.html/rd755dfe5f658c42704540ad7950cebd13673908...
https://lists.apache.org/thread.html/rd7c8fb305a8637480dc943ba08424c8992dccad...
https://lists.apache.org/thread.html/rd7c8fb305a8637480dc943ba08424c8992dccad...
https://lists.apache.org/thread.html/rd9ea411a58925cc82c32e15f541ead23cb25b4b...
https://lists.apache.org/thread.html/rd9ea411a58925cc82c32e15f541ead23cb25b4b...
https://lists.apache.org/thread.html/rdbf2a2cd1800540ae50dd78b57411229223a617...
https://lists.apache.org/thread.html/rdbf2a2cd1800540ae50dd78b57411229223a617...
https://lists.apache.org/thread.html/rdde34d53aa80193cda016272d61e6749f8a9044...
https://lists.apache.org/thread.html/rdde34d53aa80193cda016272d61e6749f8a9044...
https://lists.apache.org/thread.html/rdf4fe435891e8c35e70ea5da033b4c3da78760f...
https://lists.apache.org/thread.html/rdf4fe435891e8c35e70ea5da033b4c3da78760f...
https://lists.apache.org/thread.html/rdfe5f1c071ba9dadba18d7fb0ff13ea6ecb33da...
https://lists.apache.org/thread.html/rdfe5f1c071ba9dadba18d7fb0ff13ea6ecb33da...
https://lists.apache.org/thread.html/re0545ecced2d468c94ce4dcfa37d40a9573cc68...
https://lists.apache.org/thread.html/re0545ecced2d468c94ce4dcfa37d40a9573cc68...
https://lists.apache.org/thread.html/re3a1617d16a7367f767b8209b2151f4c1995819...
https://lists.apache.org/thread.html/re3a1617d16a7367f767b8209b2151f4c1995819...
https://lists.apache.org/thread.html/re577736ca7da51952c910b345a500b7676ea993...
https://lists.apache.org/thread.html/re577736ca7da51952c910b345a500b7676ea993...
https://lists.apache.org/thread.html/re6614b4fe7dbb945409daadb9e1cc73c02383df...
https://lists.apache.org/thread.html/re6614b4fe7dbb945409daadb9e1cc73c02383df...
https://lists.apache.org/thread.html/ree1895a256a9db951e0d97a76222909c2e1f28c...
https://lists.apache.org/thread.html/ree1895a256a9db951e0d97a76222909c2e1f28c...
https://lists.apache.org/thread.html/rf1b02dfccd27b8bbc3afd119b212452fa32e9ed...
https://lists.apache.org/thread.html/rf1b02dfccd27b8bbc3afd119b212452fa32e9ed...
https://lists.apache.org/thread.html/rf6de4c249bd74007f5f66f683c110535f46e719...
https://lists.apache.org/thread.html/rf6de4c249bd74007f5f66f683c110535f46e719...
https://lists.apache.org/thread.html/rf99f9a25ca24fe519c9346388f61b5b3a09be31...
https://lists.apache.org/thread.html/rf99f9a25ca24fe519c9346388f61b5b3a09be31...
https://lists.apache.org/thread.html/rfc9f51b4e21022b3cd6cb6f90791a6a69995602...
https://lists.apache.org/thread.html/rfc9f51b4e21022b3cd6cb6f90791a6a69995602...
https://lists.apache.org/thread.html/rfd3ff6e66b6bbcfb2fefa9f5a20328937c0369b...
https://lists.apache.org/thread.html/rfd3ff6e66b6bbcfb2fefa9f5a20328937c0369b...
https://security.netapp.com/advisory/ntap-20210611-0006/
https://www.debian.org/security/2021/dsa-4949
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuapr2022.html
https://www.oracle.com/security-alerts/cpujan2022.html
https://www.oracle.com/security-alerts/cpuoct2021.html
受影响软件情况
# 类型 厂商 产品 版本 影响面
1
运行在以下环境
应用 eclipse jetty * From
(including)
10.0.0
Up to
(excluding)
10.0.2
运行在以下环境
应用 eclipse jetty * From
(including)
11.0.0
Up to
(excluding)
11.0.2
运行在以下环境
应用 eclipse jetty * From
(including)
7.2.2
Up to
(excluding)
9.4.39
运行在以下环境
系统 debian_10 jetty9 * Up to
(excluding)
9.4.16-0+deb10u1
运行在以下环境
系统 debian_11 jetty9 * Up to
(excluding)
9.4.39-1
运行在以下环境
系统 debian_12 jetty9 * Up to
(excluding)
9.4.39-1
运行在以下环境
系统 fedora_32 jetty * Up to
(excluding)
9.4.40-1.fc32
运行在以下环境
系统 fedora_33 jetty * Up to
(excluding)
9.4.40-1.fc33
运行在以下环境
系统 fedora_34 jetty * Up to
(excluding)
9.4.40-1.fc34
运行在以下环境
系统 kylinos_aarch64_V10SP2 jetty * Up to
(excluding)
9.4.15-8.ky10
运行在以下环境
系统 kylinos_x86_64_V10SP2 jetty * Up to
(excluding)
9.4.15-8.ky10
运行在以下环境
系统 opensuse_Leap_15.3 jetty-io * Up to
(excluding)
9.4.42-3.9.1
阿里云评分
4.5
  • 攻击路径
    远程
  • 攻击复杂度
    容易
  • 权限要求
    无需权限
  • 影响范围
    有限影响
  • EXP成熟度
    N/A
  • 补丁情况
    官方补丁
  • 数据保密性
    无影响
  • 数据完整性
    无影响
  • 服务器危害
    服务器失陷
  • 全网数量
    N/A
CWE-ID 漏洞类型
CWE-400 未加控制的资源消耗(资源穷尽)
CWE-755 对异常条件的处理不恰当
阿里云安全产品覆盖情况