CVE-2022-2191 Jetty SslConnection does not release pooled ByteBuffers in case of errors
HighCVSS 7.5
EPSS 2.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
In Eclipse Jetty versions 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, SslConnection does not release ByteBuffers from configured ByteBufferPool in case of error code paths.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.eclipse.jetty/jetty-server(Maven) | >= 11.0.0, < 11.0.10 | 11.0.10 |
| org.eclipse.jetty/jetty-server(Maven) | >= 10.0.0, < 10.0.10 | 10.0.10 |
| org.eclipse.jetty/jetty-server(Maven) | = 10.0.0 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 10.0.1 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 10.0.2 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 10.0.3 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 10.0.4 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 10.0.5 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 10.0.6 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 10.0.7 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 10.0.8 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 10.0.9 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 11.0.0 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 11.0.1 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 11.0.2 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 11.0.3 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 11.0.4 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 11.0.5 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 11.0.6 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 11.0.7 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 11.0.8 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 11.0.9 | No fix listed |
| The Eclipse Foundation Eclipse Jetty | >= 10.0.0 | No fix listed |
| The Eclipse Foundation Eclipse Jetty | <= 10.0.9 | No fix listed |
| The Eclipse Foundation Eclipse Jetty | >= 11.0.0 | No fix listed |
Show 3 more
| Product | Affected versions | Fixed in |
|---|---|---|
| The Eclipse Foundation Eclipse Jetty | <= 11.0.9 | No fix listed |
| eclipse jetty | >= 10.0.0, <= 10.0.9 | No fix listed |
| eclipse jetty | >= 11.0.0, <= 11.0.9 | No fix listed |
References
- github.com exploit vendor-advisory
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com
- security.netapp.com third-party-advisory
- github.com
- github.com
- Debian Security Tracker CVE-2022-2191 vendor-advisory