| パッケージ | 影響を受けるバージョン | 修正済みバージョン |
|---|---|---|
| org.eclipse.jetty:jetty-server | ≥ 10.0.7, < 10.0.23≥ 11.0.7, < 11.0.23 | 10.0.2311.0.23 |
| jetty | ≥ 10.0.7, < 10.0.23≥ 11.0.7, < 11.0.23 | 10.0.2311.0.23 |
The original report:
Server handling of 100-Continue requests can lead to memory leak that can be abused to cause a Denial of Service state.
After investigation, turns out that every request that has a body, but reading the body may end up in reading 0 bytes, leaks a buffer. This is particularly the case for 100-Continue, but any request where the network is slow can leak.
https://github.com/jetty/jetty.project/pull/12156
No workarounds.
これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。
無料でサイトをスキャン