GHSA-8mpp-f3f7-xc28 Jetty SslConnection does not release pooled ByteBuffers in case of errors

• Maven org.eclipse.jetty:jetty-server: >= 10.0.0, < 10.0.10 → fixed in 10.0.10 • Maven org.eclipse.jetty:jetty-server: >= 11.0.0, < 11.0.10 → fixed in 11.0.10

Impact `SslConnection` does not release `ByteBuffer`s in case of error code paths. For example, TLS handshakes that require client-auth with clients that send expired certificates will trigger a TLS handshake errors and the `ByteBuffer`s used to process the TLS handshake will be leaked. Workarounds Configure explicitly a `RetainableByteBufferPool` with `max[Heap|Direct]Memory` to limit the amount of memory that is leaked. Eventually the pool will be full of "active" entries (the leaked ones) and will provide `ByteBuffer`s that will be GCed normally. _With embedded-jetty_ ``` java int maxBucketSize = 1000; long maxHeapMemory = 128 * 1024L * 1024L; // 128 MB long maxDirectMemory = 128 * 1024L * 1024L; // 128 MB RetainableByteBufferPool rbbp = new ArrayRetainableByteBufferPool(0, -1, -1, maxBucketSize, maxHeapMemory, maxDirectMemory); server.addBean(rbbp); // make sure the ArrayRetainableByteBufferPool is added before the server is started server.start(); ``` _With jetty-home/jetty-base_ Create a `${jetty.base}/etc/retainable-byte-buffer-config.xml` ``` xml ``` And then reference it in `${jetty.base}/start.d/retainable-byte-buffer-config.ini` ``` etc/retainable-byte-buffer-config.xml ``` References https://github.com/eclipse/jetty.project/issues/8161 For more information • Email us at [email protected]