Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-28165: In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invalid TLS frame.
Fixed packages 36
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | jetty-annotations | 0:9.0.3-8.amzn2.0.6 |
| Amazon Linux · 2 | jetty-ant | 0:9.0.3-8.amzn2.0.6 |
| Amazon Linux · 2 | jetty-client | 0:9.0.3-8.amzn2.0.6 |
| Amazon Linux · 2 | jetty-continuation | 0:9.0.3-8.amzn2.0.6 |
| Amazon Linux · 2 | jetty-deploy | 0:9.0.3-8.amzn2.0.6 |
| Amazon Linux · 2 | jetty-http | 0:9.0.3-8.amzn2.0.6 |
| Amazon Linux · 2 | jetty-io | 0:9.0.3-8.amzn2.0.6 |
| Amazon Linux · 2 | jetty-jaas | 0:9.0.3-8.amzn2.0.6 |
| Amazon Linux · 2 | jetty-jaspi | 0:9.0.3-8.amzn2.0.6 |
| Amazon Linux · 2 | jetty-javadoc | 0:9.0.3-8.amzn2.0.6 |
| Amazon Linux · 2 | jetty-jmx | 0:9.0.3-8.amzn2.0.6 |
| Amazon Linux · 2 | jetty-jndi | 0:9.0.3-8.amzn2.0.6 |
| Amazon Linux · 2 | jetty-jsp | 0:9.0.3-8.amzn2.0.6 |
| Amazon Linux · 2 | jetty-jspc-maven-plugin | 0:9.0.3-8.amzn2.0.6 |
| Amazon Linux · 2 | jetty-maven-plugin | 0:9.0.3-8.amzn2.0.6 |
| Amazon Linux · 2 | jetty-monitor | 0:9.0.3-8.amzn2.0.6 |
| Amazon Linux · 2 | jetty-plus | 0:9.0.3-8.amzn2.0.6 |
| Amazon Linux · 2 | jetty-project | 0:9.0.3-8.amzn2.0.6 |
| Amazon Linux · 2 | jetty-proxy | 0:9.0.3-8.amzn2.0.6 |
| Amazon Linux · 2 | jetty-rewrite | 0:9.0.3-8.amzn2.0.6 |
| Amazon Linux · 2 | jetty-runner | 0:9.0.3-8.amzn2.0.6 |
| Amazon Linux · 2 | jetty-security | 0:9.0.3-8.amzn2.0.6 |
| Amazon Linux · 2 | jetty-server | 0:9.0.3-8.amzn2.0.6 |
| Amazon Linux · 2 | jetty-servlet | 0:9.0.3-8.amzn2.0.6 |
| Amazon Linux · 2 | jetty-servlets | 0:9.0.3-8.amzn2.0.6 |
| Amazon Linux · 2 | jetty-start | 0:9.0.3-8.amzn2.0.6 |
| Amazon Linux · 2 | jetty-util | 0:9.0.3-8.amzn2.0.6 |
| Amazon Linux · 2 | jetty-util-ajax | 0:9.0.3-8.amzn2.0.6 |
| Amazon Linux · 2 | jetty-webapp | 0:9.0.3-8.amzn2.0.6 |
| Amazon Linux · 2 | jetty-websocket-api | 0:9.0.3-8.amzn2.0.6 |
| Amazon Linux · 2 | jetty-websocket-client | 0:9.0.3-8.amzn2.0.6 |
| Amazon Linux · 2 | jetty-websocket-common | 0:9.0.3-8.amzn2.0.6 |
| Amazon Linux · 2 | jetty-websocket-parent | 0:9.0.3-8.amzn2.0.6 |
| Amazon Linux · 2 | jetty-websocket-server | 0:9.0.3-8.amzn2.0.6 |
| Amazon Linux · 2 | jetty-websocket-servlet | 0:9.0.3-8.amzn2.0.6 |
| Amazon Linux · 2 | jetty-xml | 0:9.0.3-8.amzn2.0.6 |
Vulnerabilities 1
-
High 7.5
Jetty vulnerable to incorrect handling of invalid large TLS frame, exhausting CPU resources
In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invalid TLS frame.
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2021-28165.html