https://bugzilla.redhat.com/show_bug.cgi?id=1902826
Jonathan Christison <jochrist(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Comment|11 |updated
--- Comment #11 has been edited ---
A word on scoring, our scoring is currently
4.8/CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L and NVD score of
3.7/CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
My take:
Exploitability Metrics:
Attack Vector Network (AV:N) -
Agree here, Jetty is both a HTTP server and client, in the context of this
vulnerability it is the server that is affected, the component is commonly
bound to the network stack and also commonly a WAN facing service.
Attack Complexity High (AC:H)
We agree here, the attack complexity is high because there are elements outside
of GzipHandler being enabled there are other factors outside the attackers
control, these factors are
*) The end application doesn't contain any logic to handle connection closure
*) The end application doesn't fully consume a gzipped POST request
*) There is an element of chance as to if the recycled buffer will be used in
such a way to allow an attack, for example differences in network speed, OS
buffers and dispatching threads will all have a varying impact, meaning this
attack will need to be tailored to each specific target by the attacker
Privileges Required None (PR:N) -
Agree here, the attacker does not need to be a privileged user eg. no login
required to exploit the base flaw.
User Interaction None (UI:N)
Agree here, a end user does not need to be coerced into performing any action
for this flaw.
Scope Unchanged (S:U)
Agree here, the attacker will not be able to escape the scope of the executing
JVM solely due to this flaw
Impact Metrics:
Confidentiality None (C:N)
Agree here, this is a blind attack and relies on a POST request, there is no
information the attacker can divulge
Integrity Low (I:L)
We agree here, if the attacker is able to overcome the attack complexity and
predictably exploit the buffer then the contents of other POST requests can be
altered meaning data modification is taking place, but given the complexities
of the attack the attacker does not have control over the consequences of the
modification.
Availability Low (A:N -> A:L)
We disagree here with the original scoring of None for availability, the attack
if successful will in many situations cause an exception when two request
bodies are combined, depending on end application handling of these exceptions
this could mean interruption to other users of the http service.
--
You are receiving this mail because:
You are on the CC list for the bug.