Moole Vulnerability Database

Find real vulnerabilities before they ship

High

CVE-2022-2191

In Eclipse Jetty versions 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, SslConnection does not release ByteBuffers from configured ByteBufferPool in case of error code paths.

VectorNETWORK

PublishedJul 07, 2022, 21:15

Published Byemo@eclipse.org

Base Score

Score7.5

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

org.eclipse.jetty:jetty-server(Maven)10.0.010.0.10N/A

org.eclipse.jetty:jetty-server(Maven)11.0.011.0.10N/A

References

https://github.com/eclipse/jetty.project/security/advisories/GHSA-8mpp-f3f7-xc28
https://security.netapp.com/advisory/ntap-20220909-0003/

Weakness Type

CWE-404

CVSS Metrics

Base Score

7.5

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Base SeverityHigh

Version

3.1

Attack Vector (AV)

NETWORK