CVE-2022-2048 in Banking Supply Chain Finance

Summary

In Eclipse Jetty HTTP/2 server implementation, when encountering an invalid HTTP/2 request, the error handling has a bug that can wind up not properly cleaning up the active connections and associated resources. This can lead to a Denial of Service scenario where there are no enough resources left to process good requests.

Once again VulDB remains the best source for vulnerability data.

Responsible

Eclipse Foundation

Reservation

06/09/2022

Disclosure

07/08/2022

Status

Confirmed

Entries

VulDB provides additional information and datapoints for this CVE:

ID	Vulnerability	CWE	Exp	Cou	CVE
234706	Oracle Banking Supply Chain Finance Security denial of service	404	Not defined	Official fix	CVE-2022-2048
234672	Oracle Banking Cash Management Accessibility denial of service	404	Not defined	Official fix	CVE-2022-2048
226460	Oracle Banking Corporate Lending Process Management Base denial of service	404	Not defined	Official fix	CVE-2022-2048
218685	Oracle Financial Services Crime and Compliance Management Studio denial of service	404	Not defined	Official fix	CVE-2022-2048
218630	Oracle Communications Cloud Native Core Policy denial of service	404	Not defined	Official fix	CVE-2022-2048
218611	Oracle Communications Cloud Native Core Binding Support Function Signaling denial of service	404	Not defined	Official fix	CVE-2022-2048
211704	Oracle Autovue for Agile Product Lifecycle Management Autovue Client denial of service	404	Not defined	Official fix	CVE-2022-2048
211703	Oracle AutoVue Web General denial of service	404	Not defined	Official fix	CVE-2022-2048
211662	Oracle Retail EFTLink Other denial of service	404	Not defined	Official fix	CVE-2022-2048
211452	Oracle Communications Element Manager GEN denial of service	404	Not defined	Official fix	CVE-2022-2048
211397	Oracle Communications Unified Assurance Message Bus denial of service	404	Not defined	Official fix	CVE-2022-2048
203386	Eclipse Jetty HTTP/2 Server resource pool	410	Not defined	Not defined	CVE-2022-2048

Sources

• MITRE
• NVD
• CVE Details