VDB
RHSA-2021%3A2689
RHSA-2021%3A2689
PUBLISHED
CVSS 5.300000190734863 MEDIUM
In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept headers with a large number of “quality” (i.e. q) parameters, the server may enter a denial of service (DoS) state due to high CPU usage processing those quality values, resulting in minutes of CPU time exhausted processing those quality values.
Risk Scores
CVSS 3.1
5.300000190734863
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat AMQ 7.8.2 |
Timeline
- Jul 12, 2021 CVE Published
- May 1, 2026 Distribution Patch
- May 1, 2026 Distribution Patch
- May 1, 2026 Security Advisory
- May 1, 2026 Security Advisory
- May 1, 2026 Security Advisory
- May 1, 2026 Security Advisory
- May 1, 2026 Security Advisory
- May 1, 2026 Security Advisory
- May 1, 2026 Security Advisory
- May 1, 2026 Security Advisory
- May 1, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2021:2689 advisory
- https://access.redhat.com/security/updates/classification/#moderate advisory
- https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions&product=jboss.amq.broker&version=7.8.2 advisory
- https://access.redhat.com/documentation/en-us/red_hat_amq/2020.q4/ advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1927028 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=1934116 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=1936629 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=1937364 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=1944888 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=1945710 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=1945712 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=1945714 issue
- https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_2689.json advisory
- https://access.redhat.com/security/cve/CVE-2020-27223 advisory
- https://www.cve.org/CVERecord?id=CVE-2020-27223 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2020-27223 advisory
- https://github.com/eclipse/jetty.project/security/advisories/GHSA-m394-8rww-3jr7 advisory
- https://access.redhat.com/security/cve/CVE-2021-3425 advisory
- https://www.cve.org/CVERecord?id=CVE-2021-3425 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2021-3425 advisory
…and 23 more