CVE-2011-4461
At a glance
- Source
- NVD
- EPSS
- EPSS 4.92 % · percentile 92 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- mitre
- NVD status
- Modified
Description
Jetty 8.1.0.RC2 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.
Weaknesses (CWE)
References
- http://marc.info/?l=bugtraq&m=143387688830075&w=2
- https://security.netapp.com/advisory/ntap-20190307-0004/
- http://www.ubuntu.com/usn/USN-1429-1
- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
- http://www.nruns.com/_downloads/advisory28122011.pdf
- http://secunia.com/advisories/48981
- http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
- http://www.securitytracker.com/id?1026475
- http://www.kb.cert.org/vuls/id/903934
- http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html
- https://exchange.xforce.ibmcloud.com/vulnerabilities/72017
- http://archives.neohapsis.com/archives/bugtraq/2011-12/0181.html
- http://secunia.com/advisories/47408
- http://www.ocert.org/advisories/ocert-2011-003.html
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.0 | MEDIUM 5.3 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | MEDIUM 5.0 | AV:N/AC:L/Au:N/C:N/I:N/A:P | NVD · nvd@nist.gov (Primary) |
Advisories
- GHSA-qxp4-27vx-xmm3 — Improper Input Validation in Jetty
European references
- ENISA EUVD · EUVD-2022-5062
- GCVE · GCVE-0-2011-4461
CERT-FR advisories
- CERTFR-2016-AVI-136 — Multiples vulnérabilités dans Oracle Sun Systems Products Suite · cert.ssi.gouv.fr
- CERTA-2013-AVI-213 — Vulnérabilité dans IBM InfoSphere · cert.ssi.gouv.fr
- CERTA-2012-AVI-750 — Vulnérabilités dans IBM InfoSphere BigInsights · cert.ssi.gouv.fr
- CERTA-2012-AVI-537 — Multiples vulnérabilités dans IBM Rational Synergy · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:oracle:sun_storage_common_array_manager:6.9.0:*:*:*:*:*:*:*cpe:2.3:a:mortbay:jetty:*:rc2:*:*:*:*:*:*≤ 8.1.0cpe:2.3:a:mortbay:jetty:1.0:*:*:*:*:*:*:*cpe:2.3:a:mortbay:jetty:1.0.1:*:*:*:*:*:*:*cpe:2.3:a:mortbay:jetty:1.1:*:*:*:*:*:*:*cpe:2.3:a:mortbay:jetty:1.1.1:*:*:*:*:*:*:*cpe:2.3:a:mortbay:jetty:1.2.0:*:*:*:*:*:*:*cpe:2.3:a:mortbay:jetty:1.3.0:*:*:*:*:*:*:*cpe:2.3:a:mortbay:jetty:1.3.1:*:*:*:*:*:*:*cpe:2.3:a:mortbay:jetty:1.3.2:*:*:*:*:*:*:*cpe:2.3:a:mortbay:jetty:1.3.3:*:*:*:*:*:*:*cpe:2.3:a:mortbay:jetty:1.3.4:*:*:*:*:*:*:*cpe:2.3:a:mortbay:jetty:1.3.5:*:*:*:*:*:*:*cpe:2.3:a:mortbay:jetty:2.0:alpha1:*:*:*:*:*:*cpe:2.3:a:mortbay:jetty:2.0:alpha2:*:*:*:*:*:*cpe:2.3:a:mortbay:jetty:2.0:beta1:*:*:*:*:*:*cpe:2.3:a:mortbay:jetty:2.0:beta2:*:*:*:*:*:*cpe:2.3:a:mortbay:jetty:2.0.0:*:*:*:*:*:*:*cpe:2.3:a:mortbay:jetty:2.0.1:*:*:*:*:*:*:*cpe:2.3:a:mortbay:jetty:2.0.2:*:*:*:*:*:*:*cpe:2.3:a:mortbay:jetty:2.0.3:*:*:*:*:*:*:*cpe:2.3:a:mortbay:jetty:2.0.4:*:*:*:*:*:*:*cpe:2.3:a:mortbay:jetty:2.0.5:*:*:*:*:*:*:*cpe:2.3:a:mortbay:jetty:2.1.0:*:*:*:*:*:*:*cpe:2.3:a:mortbay:jetty:2.1.1:*:*:*:*:*:*:*cpe:2.3:a:mortbay:jetty:2.1.2:*:*:*:*:*:*:*cpe:2.3:a:mortbay:jetty:2.1.3:*:*:*:*:*:*:*cpe:2.3:a:mortbay:jetty:2.1.4:*:*:*:*:*:*:*cpe:2.3:a:mortbay:jetty:2.1.5:*:*:*:*:*:*:*cpe:2.3:a:mortbay:jetty:2.1.6:*:*:*:*:*:*:*cpe:2.3:a:mortbay:jetty:2.1.7:*:*:*:*:*:*:*cpe:2.3:a:mortbay:jetty:2.1.b0:*:*:*:*:*:*:*cpe:2.3:a:mortbay:jetty:2.1.b1:*:*:*:*:*:*:*cpe:2.3:a:mortbay:jetty:2.2:alpha0:*:*:*:*:*:*cpe:2.3:a:mortbay:jetty:2.2:alpha1:*:*:*:*:*:*cpe:2.3:a:mortbay:jetty:2.2:beta0:*:*:*:*:*:*cpe:2.3:a:mortbay:jetty:2.2:beta1:*:*:*:*:*:*cpe:2.3:a:mortbay:jetty:2.2:beta2:*:*:*:*:*:*cpe:2.3:a:mortbay:jetty:2.2:beta3:*:*:*:*:*:*cpe:2.3:a:mortbay:jetty:2.2:beta4:*:*:*:*:*:*- +301 more
Affected products
| Product | Versions |
|---|---|
| affected n/a |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |