CVE-2021-28165
High
Description
In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invalid TLS frame.
SeverityHigh
CVSS7.5
Exploit probability—
Product
Eclipse Jetty
PublishedApr 1, 2021
First seenApr 1, 2021
How to fix
Update
- eclipse jetty9.4.39, 10.0.2, 11.0.2 or later
- oracle rest_data_services21.3 or later
- jenkins jenkins2.277.3, 2.286 or later
- netapp cloud_manager3.9.8 or later
- netapp e-series_performance_analyzer3.0 or later
- netapp e-series_santricity_os_controller11.70.1 or later
- netapp e-series_santricity_storage1.10 or later
- netapp e-series_santricity_web_services5.1 or later
- netapp ontap_tools9.10 or later
- netapp santricity_web_services_proxy5.1 or later
- netapp snapcenter4.6 or later
- netapp storage_replication_adapter_for_clustered_data_ontap9.10 or later
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| eclipse jetty | 7.2.2 ≤ v < 9.4.39, 10.0.0 ≤ v < 10.0.2, 11.0.0 ≤ v < 11.0.2 | 9.4.39, 10.0.2, 11.0.2 |
| oracle autovue_for_agile_product_lifecycle_management | 21.0.2 | — |
| oracle communications_cloud_native_core_policy | 1.14.0 | — |
| oracle communications_element_manager | 8.2.2 | — |
| oracle communications_services_gatekeeper | 7.0 | — |
| oracle communications_session_report_manager | 8.0.0.0 ≤ v ≤ 8.2.4.0 | — |
| oracle communications_session_route_manager | 8.0.0.0 ≤ v ≤ 8.2.4.0 | — |
| oracle rest_data_services | v < 21.3 | 21.3 |
| oracle siebel_core_-_automation | v ≤ 21.9 | — |
| jenkins jenkins | v < 2.277.3, v < 2.286 | 2.277.3, 2.286 |
| netapp cloud_manager | v < 3.9.8 | 3.9.8 |
| netapp e-series_performance_analyzer | v < 3.0 | 3.0 |
| netapp e-series_santricity_os_controller | 11.0.0 ≤ v < 11.70.1 | 11.70.1 |
| netapp e-series_santricity_storage | v < 1.10 | 1.10 |
| netapp e-series_santricity_web_services | v < 5.1 | 5.1 |
| netapp ontap_tools | v < 9.10 | 9.10 |
| netapp santricity_cloud_connector | No range specified | — |
| netapp santricity_web_services_proxy | v < 5.1 | 5.1 |
| netapp snapcenter | v < 4.6 | 4.6 |
| netapp storage_replication_adapter_for_clustered_data_ontap | v < 9.10 | 9.10 |
| netapp vasa_provider_for_clustered_data_ontap | v < 9.10 | 9.10 |
| org.eclipse.jetty:jetty-serverMaven | 7.2.2 ≤ v < 9.4.39, 10.0.0 ≤ v < 10.0.2, 11.0.0 ≤ v < 11.0.2 | 9.4.39, 10.0.2, 11.0.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.