CVE-2024-7708: High severity requests vulnerability
Impact The original report:
> Server handling of 100-Continue requests can lead to memory leak that can be abused to cause a Denial of Service state.
After investigation, turns out that every request that has a body, but reading the body may end up in reading 0 bytes, leaks a buffer. This is particularly the case for 100-Continue, but any request where the network is slow can leak.
Affected Versions
Jetty 11.0.0-11.0.22 (EOL) Jetty 10.0.0-10.0.22 (EOL)
Patched Versions
Jetty 11.0.23 Jetty 10.0.23
Patches
https://github.com/jetty/jetty.project/pull/12156
Workarounds
No workarounds.
Other sources
For requests that have a body, but reading the body may end up in reading 0 bytes, there is a buffer leak. This is particularly the case for 100-Continue, but any request where the network is slow can leak.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.eclipse.jetty:jetty-serverto a version that resolves this vulnerability.Fixed in 11.0.23 - Upgrade
Upgrade
maven/org.eclipse.jetty:jetty-serverto a version that resolves this vulnerability.Fixed in 10.0.23 - Upgrade
Upgrade
Jettyto a version that resolves this vulnerability.Fixed in 10.0.23 - Upgrade
Upgrade
Jettyto a version that resolves this vulnerability.Fixed in 11.0.23
Event History
Frequently Asked Questions
What is the severity of CVE-2024-7708?
The severity of CVE-2024-7708 is high with a score of 7.5.
What are the main risks associated with CVE-2024-7708?
CVE-2024-7708 poses a risk of sensitive data exposure due to a buffer leak that can occur with slow network requests.
How do I fix CVE-2024-7708?
To fix CVE-2024-7708, ensure that body reading and buffer handling mechanisms are properly implemented to prevent leaks.
What types of requests are affected by CVE-2024-7708?
CVE-2024-7708 affects requests that contain a body, particularly in situations involving a slow network or 100-Continue responses.
Is there a workaround for CVE-2024-7708 until a patch is available?
A possible workaround for CVE-2024-7708 is to restrict the usage of body data in requests where performance concerns exist.