CVE-2025-5115

描述

In Eclipse Jetty, versions <=9.4.57, <=10.0.25, <=11.0.25, <=12.0.21, <=12.1.0.alpha2, an HTTP/2 client may trigger the server to send RST_STREAM frames, for example by sending frames that are malformed or that should not be sent in a particular stream state, therefore forcing the server to consume resources such as CPU and memory. For example, a client can open a stream and then send WINDOW_UPDATE frames with window size increment of 0, which is illegal. Per specification https://www.rfc-editor.org/rfc/rfc9113.html#name-window_update , the server should send a RST_STREAM frame. The client can now open another stream and send another bad WINDOW_UPDATE, therefore causing the server to consume more resources than necessary, as this case does not exceed the max number of concurrent streams, yet the client is able to create an enormous amount of streams in a short period of time. The attack can be performed with other conditions (for example, a DATA frame for a closed stream) that cause the server to send a RST_STREAM frame. Links: * https://github.com/jetty/jetty.project/security/advisories/GHSA-mmxm-8w33-wc4h

如何修補 CVE-2025-5115

要修補 CVE-2025-5115,請將受影響套件升級到下列已修補版本。

• —升級至 12.0.17-3.1~deb13u1 或更新版本
• —升級至 12.0.17-3.1~deb13u1 或更新版本
• —升級至 9.4.57-0+deb11u3 或更新版本
• —升級至 9.4.57-0+deb11u3 或更新版本
• —升級至 9.4.57-1.1~deb12u1 或更新版本
• —升級至 9.4.58 或更新版本
• —升級至 12.0.25 或更新版本

CVE-2025-5115 正在被利用嗎?

低 — EPSS 為 1.6%,目前沒有觀察到大規模利用活動。

受影響套件(7)

• from 0, < 12.0.17-3.1~deb13u1
• from 0, < 12.0.17-3.1~deb13u1
• from 0, < 9.4.57-0+deb11u3
• from 0, < 9.4.57-0+deb11u3
• from 0, < 9.4.57-1.1~deb12u1
• >= 9.3.0, < 9.4.58
• >= 12.0.0, < 12.0.25

CVSS 分數

參考連結(15)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2025-5115
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2025-5115
• PATCHgithub.com/jetty/jetty.project
• WEBwww.openwall.com/lists/oss-security/2025/08/20/4
• WEB