https://bugzilla.redhat.com/show_bug.cgi?id=1934116
--- Comment #10 from Jonathan Christison <jochrist(a)redhat.com> ---
A word on scoring, our scoring is currently
5.3/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L and NVD of
7.5/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H will change to
5.3/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
My take:
Exploitability Metrics:
Attack Vector Network (AV:N) -
Agree here, Jetty is both a HTTP server and client, in the context of this
vulnerability it is the server that is affected, the component is commonly
bound to the network stack and also commonly a WAN facing service.
Attack Complexity Low (AC:L)
Agree here, the attack complexity is low, although there is the complexity of
application configuration making this attack less viable and should only expose
the user when using one of the below features, we consider this configuration
which we assume is in place for the purposes of the base score
* Using the default error page/handler
* Exposing StatisticsServlet to network traffic
* Application using getLocale API
* pre-compressed static content in the DefaultServlet is enabled
Privileges Required None (PR:N) -
Agree here, the attacker does not need to be a privileged user eg. no login
required to exploit the base flaw.
User Interaction None (UI:N)
Agree here, a user does not need to be coerced into performing any action for
this flaw, an attacker can expect to be successful if the jetty service is
configured with any of the prerequisite mentioned in the AC section
Scope Unchanged (S:U)
Agree here, the attacker will not be able to escape the scope of the executing
JVM solely due to this flaw
Impact Metrics:
Confidentiality None (C:N)
Agree here, there is no loss of confidentiality within the impacted component
and nothing is disclosed to the attacker through this attack
Integrity None (I:N)
Agree here, there is no loss of integrity within the impacted component and no
data is altered by the attacker
Availability High (A:H) -> Availability Low (A:L)
We disagree here, although this is a DoS attack there is not a total, sustained
or serious loss of availability in all circumstances, all requests will
continue to be handled but the CPU usage will increase, this may result in
reduced performance or some interruptions in resource availability but the
attacker doesn't have the ability to deny all resources to legitimate users at
will.
--
You are receiving this mail because:
You are on the CC list for the bug.