2021-03-12 01:00:44 +00:00
{
"data_type" : "CVE" ,
"data_format" : "MITRE" ,
"data_version" : "4.0" ,
"CVE_data_meta" : {
"ID" : "CVE-2021-28165" ,
2021-04-01 10:13:46 -04:00
"ASSIGNER" : "security@eclipse.org" ,
"STATE" : "PUBLIC"
} ,
"affects" : {
"vendor" : {
"vendor_data" : [
{
"vendor_name" : "The Eclipse Foundation" ,
"product" : {
"product_data" : [
{
"product_name" : "Eclipse Jetty" ,
"version" : {
"version_data" : [
{
"version_affected" : ">=" ,
"version_value" : "7.2.2"
} ,
{
"version_affected" : "<=" ,
"version_value" : "9.4.38"
} ,
{
"version_affected" : ">=" ,
"version_value" : "10.0.0.alpha0"
} ,
{
"version_affected" : "<=" ,
"version_value" : "10.0.1"
} ,
{
"version_affected" : ">=" ,
"version_value" : "11.0.0.alpha0"
} ,
{
"version_affected" : "<=" ,
"version_value" : "11.0.1"
}
]
}
}
]
}
}
]
}
2021-03-12 01:00:44 +00:00
} ,
"description" : {
"description_data" : [
{
"lang" : "eng" ,
2021-04-01 10:13:46 -04:00
"value" : "In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invalid TLS frame."
}
]
} ,
"impact" : {
"cvss" : {
"baseScore" : 7.5 ,
"vectorString" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" ,
"version" : "3.1"
}
} ,
"problemtype" : {
"problemtype_data" : [
{
"description" : [
{
"lang" : "eng" ,
"value" : "CWE-400"
}
]
} ,
{
"description" : [
{
"lang" : "eng" ,
"value" : "CWE-551"
}
]
}
]
} ,
"references" : {
"reference_data" : [
{
"name" : "https://github.com/eclipse/jetty.project/security/advisories/GHSA-26vr-8j45-3r4w" ,
"refsource" : "CONFIRM" ,
"url" : "https://github.com/eclipse/jetty.project/security/advisories/GHSA-26vr-8j45-3r4w"
2021-04-07 14:00:41 +00:00
} ,
{
"refsource" : "MLIST" ,
"name" : "[zookeeper-issues] 20210407 [jira] [Updated] (ZOOKEEPER-4277) dependency-check:check failing - jetty-server-9.4.39 CVE-2021-28165" ,
"url" : "https://lists.apache.org/thread.html/r17e26cf9a1e3cbc09522d15ece5d7c7a00cdced7641b92a22a783287@%3Cissues.zookeeper.apache.org%3E"
} ,
{
"refsource" : "MLIST" ,
"name" : "[zookeeper-issues] 20210407 [jira] [Assigned] (ZOOKEEPER-4277) dependency-check:check failing - jetty-server-9.4.39 CVE-2021-28165" ,
"url" : "https://lists.apache.org/thread.html/r5f172f2dd8fb02f032ef4437218fd4f610605a3dd4f2a024c1e43b94@%3Cissues.zookeeper.apache.org%3E"
} ,
{
"refsource" : "MLIST" ,
"name" : "[zookeeper-notifications] 20210407 [GitHub] [zookeeper] nkalmar opened a new pull request #1675: ZOOKEEPER-4277: update jetty to 9.4.39 due to CVE-2021-28165" ,
"url" : "https://lists.apache.org/thread.html/ra210e38ae0bf615084390b26ba01bb5d66c0a76f232277446ae0948a@%3Cnotifications.zookeeper.apache.org%3E"
} ,
{
"refsource" : "MLIST" ,
"name" : "[zookeeper-issues] 20210407 [jira] [Updated] (ZOOKEEPER-4277) dependency-check:check failing - jetty-server-9.4.38 CVE-2021-28165" ,
"url" : "https://lists.apache.org/thread.html/re577736ca7da51952c910b345a500b7676ea9931c9b19709b87f292b@%3Cissues.zookeeper.apache.org%3E"
} ,
{
"refsource" : "MLIST" ,
"name" : "[zookeeper-issues] 20210407 [jira] [Created] (ZOOKEEPER-4277) dependency-check:check failing - jetty-server-9.4.39 CVE-2021-28165" ,
"url" : "https://lists.apache.org/thread.html/rbcd7b477df55857bb6cae21fcc4404683ac98aac1a47551f0dc55486@%3Cissues.zookeeper.apache.org%3E"
} ,
{
"refsource" : "MLIST" ,
"name" : "[zookeeper-notifications] 20210407 [GitHub] [zookeeper] nkalmar commented on pull request #1675: ZOOKEEPER-4277: update jetty to 9.4.39 due to CVE-2021-28165" ,
"url" : "https://lists.apache.org/thread.html/r9db72e9c33b93eba45a214af588f1d553839b5c3080fc913854a49ab@%3Cnotifications.zookeeper.apache.org%3E"
} ,
{
"refsource" : "MLIST" ,
"name" : "[zookeeper-dev] 20210407 [jira] [Created] (ZOOKEEPER-4277) dependency-check:check failing - jetty-server-9.4.39 CVE-2021-28165" ,
"url" : "https://lists.apache.org/thread.html/re6614b4fe7dbb945409daadb9e1cc73c02383df68bf9334736107a6e@%3Cdev.zookeeper.apache.org%3E"
2021-04-07 15:00:39 +00:00
} ,
{
"refsource" : "MLIST" ,
"name" : "[zookeeper-dev] 20210407 Re: [VOTE] Apache ZooKeeper release 3.6.3 candidate 1" ,
"url" : "https://lists.apache.org/thread.html/r56e5568ac73daedcb3b5affbb4b908999f03d3c1b1ada3920b01e959@%3Cdev.zookeeper.apache.org%3E"
} ,
{
"refsource" : "MLIST" ,
"name" : "[zookeeper-notifications] 20210407 [GitHub] [zookeeper] nkalmar opened a new pull request #1676: ZOOKEEPER-4277: update jetty to 9.4.39 due to CVE-2021-28165" ,
"url" : "https://lists.apache.org/thread.html/ra21b3e6bd9669377139fe33fb46edf6fece3f31375bc42a0dcc964b2@%3Cnotifications.zookeeper.apache.org%3E"
} ,
{
"refsource" : "MLIST" ,
"name" : "[zookeeper-notifications] 20210407 [GitHub] [zookeeper] nkalmar edited a comment on pull request #1675: ZOOKEEPER-4277: update jetty to 9.4.39 due to CVE-2021-28165" ,
"url" : "https://lists.apache.org/thread.html/rbba0b02a3287e34af328070dd58f7828612f96e2e64992137f4dc63d@%3Cnotifications.zookeeper.apache.org%3E"
2021-03-12 01:00:44 +00:00
}
]
}
2021-04-07 14:00:41 +00:00
}
