CVE-2021-28165

high · 7.5

In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invalid TLS frame.

7.5

CVSS

53.9%

EPSS (exploit prob.)

99th

EPSS percentile

2021-04-01

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses

CWE-400CWE-551CWE-755

Affected products

Vendor	Product	Affected versions
eclipse	jetty	>= 7.2.2, < 9.4.39
eclipse	jetty	>= 10.0.0, < 10.0.2
eclipse	jetty	>= 11.0.0, < 11.0.2
oracle	autovue_for_agile_product_lifecycle_management	21.0.2
oracle	communications_cloud_native_core_policy	1.14.0
oracle	communications_element_manager	8.2.2
oracle	communications_services_gatekeeper	7.0
oracle	communications_session_report_manager	>= 8.0.0.0, <= 8.2.4.0
oracle	communications_session_route_manager	>= 8.0.0.0, <= 8.2.4.0
oracle	rest_data_services	< 21.3
oracle	siebel_core_-_automation	<= 21.9
jenkins	jenkins	< 2.277.3
jenkins	jenkins	< 2.286
netapp	cloud_manager	< 3.9.8
netapp	e-series_performance_analyzer	< 3.0
netapp	e-series_santricity_os_controller	>= 11.0.0, < 11.70.1
netapp	e-series_santricity_storage	< 1.10
netapp	e-series_santricity_web_services	< 5.1
netapp	ontap_tools	< 9.10
netapp	santricity_cloud_connector	all versions
netapp	santricity_web_services_proxy	< 5.1
netapp	snapcenter	< 4.6
netapp	storage_replication_adapter_for_clustered_data_ontap	< 9.10
netapp	vasa_provider_for_clustered_data_ontap	< 9.10

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2021-28165