CVE-2022-2048 - http2-server: Invalid HTTP/2 requests cause DoS

Back Back to CVE browser

HIGH

http2-server: Invalid HTTP/2 requests cause DoS

Published Jul 7, 2022

7.5

HIGH

CVSS 3.1

EPSS 2.56%

Description

In Eclipse Jetty HTTP/2 server implementation, when encountering an invalid HTTP/2 request, the error handling has a bug that can wind up not properly cleaning up the active connections and associated resources. This can lead to a Denial of Service scenario where there are no enough resources left to process good requests.

Affected products

Vendor The Eclipse Foundation Product Eclipse Jetty Default
unknown
Affected
- ≥ 10.0.0, < unspecified
- ≥ 11.0.0, < unspecified
- ≥ 9.4.0, < unspecified
- ≥ unspecified, ≤ 10.0.9
- ≥ unspecified, ≤ 11.0.9
- ≥ unspecified, ≤ 9.4.46

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
The Eclipse Foundation	Eclipse Jetty	unknown	Affected ≥ 10.0.0, < unspecified ≥ 11.0.0, < unspecified ≥ 9.4.0, < unspecified ≥ unspecified, ≤ 10.0.9 ≥ unspecified, ≤ 11.0.9 ≥ unspecified, ≤ 9.4.46

OpenShift Developer Tools and Services for OCP 4.11

jenkins-0:2.401.1.1686831596-3.el8

Fixed · RHSA-2023:3663
Red Hat AMQ Streams 2.3.0

http2-server

Fixed · RHSA-2023:0189
Red Hat Fuse 7.11.1

http2-server

Fixed · RHSA-2022:8652
Red Hat OpenShift Container Platform 4.8

jenkins-0:2.361.1.1672840472-1.el8

Fixed · RHSA-2023:0017
Red Hat OpenShift Container Platform 4.9

jenkins-0:2.361.1.1675668150-1.el8

Fixed · RHSA-2023:0777
A-MQ Clients 2

http2-server

Not affected
Red Hat AMQ Broker 7

http2-server

Will not fix
Red Hat Data Grid 8

http2-server

Not affected
Red Hat Integration Camel K 1

http2-server

Not affected
Red Hat Integration Camel Quarkus 1

http2-server

Not affected
Red Hat JBoss Data Grid 7

http2-server

Out of support scope
Red Hat JBoss Enterprise Application Platform 7

http2-server

Not affected
Red Hat JBoss Enterprise Application Platform Expansion Pack

http2-server

Not affected
Red Hat OpenShift Container Platform 3.11

jenkins

Will not fix
Red Hat OpenStack Platform 13 (Queens)

opendaylight

Out of support scope
Red Hat build of Debezium 1

http2-server

Not affected
Red Hat build of Quarkus

http2-server

Not affected

Product	Package	State	Advisory
OpenShift Developer Tools and Services for OCP 4.11	jenkins-0:2.401.1.1686831596-3.el8	Fixed	RHSA-2023:3663
Red Hat AMQ Streams 2.3.0	http2-server	Fixed	RHSA-2023:0189
Red Hat Fuse 7.11.1	http2-server	Fixed	RHSA-2022:8652
Red Hat OpenShift Container Platform 4.8	jenkins-0:2.361.1.1672840472-1.el8	Fixed	RHSA-2023:0017
Red Hat OpenShift Container Platform 4.9	jenkins-0:2.361.1.1675668150-1.el8	Fixed	RHSA-2023:0777
A-MQ Clients 2	http2-server	Not affected	n/a
Red Hat AMQ Broker 7	http2-server	Will not fix	n/a
Red Hat Data Grid 8	http2-server	Not affected	n/a
Red Hat Integration Camel K 1	http2-server	Not affected	n/a
Red Hat Integration Camel Quarkus 1	http2-server	Not affected	n/a
Red Hat JBoss Data Grid 7	http2-server	Out of support scope	n/a
Red Hat JBoss Enterprise Application Platform 7	http2-server	Not affected	n/a
Red Hat JBoss Enterprise Application Platform Expansion Pack	http2-server	Not affected	n/a
Red Hat OpenShift Container Platform 3.11	jenkins	Will not fix	n/a
Red Hat OpenStack Platform 13 (Queens)	opendaylight	Out of support scope	n/a
Red Hat build of Debezium 1	http2-server	Not affected	n/a
Red Hat build of Quarkus	http2-server	Not affected	n/a

Remediation

No remediation recorded yet.

Weaknesses (3)

CWE-400

Uncontrolled Resource Consumption

CWE-410

CWE-664

References (11)

http://www.openwall.com/lists/oss-security/2022/09/09/2
mailing-listx_refsource_MLISTMailing ListThird Party Advisory
https://access.redhat.com/security/cve/CVE-2022-2048
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2116952
Issue Tracking
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-6436
Advisory
https://github.com/advisories/GHSA-wgmr-mf83-7x4j
Advisory
https://github.com/eclipse/jetty.project/security/advisories/GHSA-wgmr-mf83-7x4j
x_refsource_CONFIRMThird Party Advisory
https://lists.debian.org/debian-lts-announce/2022/08/msg00011.html
mailing-listx_refsource_MLISTMailing ListThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-2048
https://security.netapp.com/advisory/ntap-20220901-0006/
x_refsource_CONFIRMThird Party Advisory
https://www.cve.org/CVERecord?id=CVE-2022-2048
https://www.debian.org/security/2022/dsa-5198
vendor-advisoryx_refsource_DEBIANThird Party Advisory

Link	Providers	Tags
http://www.openwall.com/lists/oss-security/2022/09/09/2		mailing-listx_refsource_MLISTMailing ListThird Party Advisory
https://access.redhat.com/security/cve/CVE-2022-2048		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2116952		Issue Tracking
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-6436		Advisory
https://github.com/advisories/GHSA-wgmr-mf83-7x4j		Advisory
https://github.com/eclipse/jetty.project/security/advisories/GHSA-wgmr-mf83-7x4j		x_refsource_CONFIRMThird Party Advisory
https://lists.debian.org/debian-lts-announce/2022/08/msg00011.html		mailing-listx_refsource_MLISTMailing ListThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-2048
https://security.netapp.com/advisory/ntap-20220901-0006/		x_refsource_CONFIRMThird Party Advisory
https://www.cve.org/CVERecord?id=CVE-2022-2048
https://www.debian.org/security/2022/dsa-5198		vendor-advisoryx_refsource_DEBIANThird Party Advisory