Skip to content
OpenAdvisories
Medium ALAS2-2024-2702 1 CVE

Moderate: jetty security update (Amazon Linux 2)

Published Dec 5, 2024 · Updated Dec 19, 2024

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-9823: There exists a security vulnerability in Jetty's DosFilter which can be exploited by unauthorized users to cause remote denial-of-service (DoS) attack on the server using DosFilter. By repeatedly sending crafted requests, attackers can trigger OutofMemory errors and exhaust the server's memory finally.

Fixed packages 36

ReleasePackageFixed in
Amazon Linux · 2 jetty-annotations 0:9.0.3-8.amzn2.0.4
Amazon Linux · 2 jetty-ant 0:9.0.3-8.amzn2.0.4
Amazon Linux · 2 jetty-client 0:9.0.3-8.amzn2.0.4
Amazon Linux · 2 jetty-continuation 0:9.0.3-8.amzn2.0.4
Amazon Linux · 2 jetty-deploy 0:9.0.3-8.amzn2.0.4
Amazon Linux · 2 jetty-http 0:9.0.3-8.amzn2.0.4
Amazon Linux · 2 jetty-io 0:9.0.3-8.amzn2.0.4
Amazon Linux · 2 jetty-jaas 0:9.0.3-8.amzn2.0.4
Amazon Linux · 2 jetty-jaspi 0:9.0.3-8.amzn2.0.4
Amazon Linux · 2 jetty-javadoc 0:9.0.3-8.amzn2.0.4
Amazon Linux · 2 jetty-jmx 0:9.0.3-8.amzn2.0.4
Amazon Linux · 2 jetty-jndi 0:9.0.3-8.amzn2.0.4
Amazon Linux · 2 jetty-jsp 0:9.0.3-8.amzn2.0.4
Amazon Linux · 2 jetty-jspc-maven-plugin 0:9.0.3-8.amzn2.0.4
Amazon Linux · 2 jetty-maven-plugin 0:9.0.3-8.amzn2.0.4
Amazon Linux · 2 jetty-monitor 0:9.0.3-8.amzn2.0.4
Amazon Linux · 2 jetty-plus 0:9.0.3-8.amzn2.0.4
Amazon Linux · 2 jetty-project 0:9.0.3-8.amzn2.0.4
Amazon Linux · 2 jetty-proxy 0:9.0.3-8.amzn2.0.4
Amazon Linux · 2 jetty-rewrite 0:9.0.3-8.amzn2.0.4
Amazon Linux · 2 jetty-runner 0:9.0.3-8.amzn2.0.4
Amazon Linux · 2 jetty-security 0:9.0.3-8.amzn2.0.4
Amazon Linux · 2 jetty-server 0:9.0.3-8.amzn2.0.4
Amazon Linux · 2 jetty-servlet 0:9.0.3-8.amzn2.0.4
Amazon Linux · 2 jetty-servlets 0:9.0.3-8.amzn2.0.4
Amazon Linux · 2 jetty-start 0:9.0.3-8.amzn2.0.4
Amazon Linux · 2 jetty-util 0:9.0.3-8.amzn2.0.4
Amazon Linux · 2 jetty-util-ajax 0:9.0.3-8.amzn2.0.4
Amazon Linux · 2 jetty-webapp 0:9.0.3-8.amzn2.0.4
Amazon Linux · 2 jetty-websocket-api 0:9.0.3-8.amzn2.0.4
Amazon Linux · 2 jetty-websocket-client 0:9.0.3-8.amzn2.0.4
Amazon Linux · 2 jetty-websocket-common 0:9.0.3-8.amzn2.0.4
Amazon Linux · 2 jetty-websocket-parent 0:9.0.3-8.amzn2.0.4
Amazon Linux · 2 jetty-websocket-server 0:9.0.3-8.amzn2.0.4
Amazon Linux · 2 jetty-websocket-servlet 0:9.0.3-8.amzn2.0.4
Amazon Linux · 2 jetty-xml 0:9.0.3-8.amzn2.0.4

Vulnerabilities 1

  • Medium 5.3
    CVE-2024-9823

    Jetty DOS vulnerability on DosFilter

    There exists a security vulnerability in Jetty's DosFilter which can be exploited by unauthorized users to cause remote denial-of-service (DoS) attack on the server using DosFilter. By repeatedly sending crafted requests, attackers can trigger OutofMemory err…

    Eclipse Foundation Eclipse Jetty Jetty Jetty Debian Ubuntu Wolfi Maven

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-9823.html