CVE-2021-28165highCWE-400CWE-551CWE-755

CVE-2021-28165: high-severity vulnerability in The Eclipse Foundation Eclipse Jetty

Published · Updated

Follow this CVE+ Monitor Eclipse Jetty+ Monitor jetty9

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.5epss 54%
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Affected
9 products (55 components)
Red Hat Enterprise Linux 7 · Red Hat Enterprise Linux 8 · Red Hat OpenShift Container Platform 4 · Red Hat JBoss Fuse 6 · Red Hat OpenShift Container Platform 3.11 · and others 4
no_fix_planned: Out of support scope
Fixed
10 products (54 components)
Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7) · Red Hat Developer Tools for Red Hat Enterprise Linux Workstation (v. 7) · Red Hat OpenShift Container Platform 4.7 · RHAF Camel-K 1.8 · Red Hat AMQ 7.8.2 · and others 5
fix ↗
Not affected
1 product (73 components) — because the vulnerable code is not present in the product
Red Hat OpenShift Container Platform 4.7
In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invalid TLS frame.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
The Eclipse Foundation · Eclipse Jetty
Related CVEs — The Eclipse Foundation Eclipse Jetty

In the same product, most dangerous first.

CVE-2021-34429MEDIUMCVE-2021-34429EPSS 99.3%CVE-2021-28164MEDIUMCVE-2021-28164EPSS 82.4%CVE-2021-28169MEDIUMCVE-2021-28169EPSS 78.5%CVE-2020-27223MEDIUMCVE-2020-27223EPSS 78.0%CVE-2017-7658—CVE-2017-7658EPSS 19.0%CVE-2017-7657—CVE-2017-7657EPSS 14.4%