CVE-2020-27218

The Eclipse Foundation Eclipse Jetty

MEDIUM 4.8

En bref

Source: NVD
EPSS: EPSS 8.28 % · centile 95 (2026-10-28)
État: PUBLISHED
Publiée: 2020-11-28 00:00 UTC
Mise à jour: 2024-08-04 16:11 UTC
Attribuée par: eclipse
Statut NVD: Modified

Description

In Eclipse Jetty version 9.4.0.RC0 to 9.4.34.v20201102, 10.0.0.alpha0 to 10.0.0.beta2, and 11.0.0.alpha0 to 11.0.0.beta2, if GZIP request body inflation is enabled and requests from different clients are multiplexed onto a single connection, and if an attacker can send a request with a body that is received entirely but not consumed by the application, then a subsequent request on the same connection will see that body prepended to its body. The attacker will not see any data but may inject data into the body of the subsequent request.

Faiblesses (CWE)

CWE-226 — Informations sensibles non effacées d'une ressource avant réutilisation

Références

Scores

Version	Score	Vecteur	Évalué par
CVSS 3.1	MEDIUM 4.8	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L	NVD · nvd@nist.gov (Primary)
CVSS 2.0	MEDIUM 5.8	AV:N/AC:M/Au:N/C:N/I:P/A:P	NVD · nvd@nist.gov (Primary)

Avis

GHSA-86wm-rrjm-8wh8 — Buffer not correctly recycled in Gzip Request inflation

Références européennes

ENISA EUVD · EUVD-2020-1488
GCVE · GCVE-0-2020-27218

Avis du CERT-FR

CERTFR-2023-AVI-0357 — Multiples vulnérabilités dans IBM Cognos · cert.ssi.gouv.fr
CERTFR-2021-AVI-951 — Multiples vulnérabilités dans le noyau Linux de RedHat · cert.ssi.gouv.fr

Configurations affectées (CPE NVD)

cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:* ≥ 9.4.0 < 9.4.35
cpe:2.3:a:eclipse:jetty:10.0.0:alpha0:*:*:*:*:*:*
cpe:2.3:a:eclipse:jetty:10.0.0:alpha1:*:*:*:*:*:*
cpe:2.3:a:eclipse:jetty:10.0.0:beta0:*:*:*:*:*:*
cpe:2.3:a:eclipse:jetty:10.0.0:beta1:*:*:*:*:*:*
cpe:2.3:a:eclipse:jetty:10.0.0:beta2:*:*:*:*:*:*
cpe:2.3:a:eclipse:jetty:11.0.0:alpha0:*:*:*:*:*:*
cpe:2.3:a:eclipse:jetty:11.0.0:beta1:*:*:*:*:*:*
cpe:2.3:a:eclipse:jetty:11.0.0:beta2:*:*:*:*:*:*
cpe:2.3:a:netapp:oncommand_system_manager:*:*:*:*:*:*:*:* ≥ 3.0 ≤ 3.1.3
cpe:2.3:a:netapp:snap_creator_framework:-:*:*:*:*:*:*:*
cpe:2.3:a:oracle:blockchain_platform:*:*:*:*:*:*:*:* < 21.1.2
cpe:2.3:a:oracle:communications_converged_application_server_-_service_controller:6.2:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_offline_mediation_controller:12.0.0.3.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_pricing_design_center:12.0.0.3.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_services_gatekeeper:7.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_session_route_manager:*:*:*:*:*:*:*:* ≥ 8.0.0 ≤ 8.2.4
cpe:2.3:a:oracle:flexcube_private_banking:12.0.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:flexcube_private_banking:12.1.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:hyperion_infrastructure_technology:11.1.2.6.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:rest_data_services:*:*:*:*:-:*:*:* < 20.4.3.050.1904
cpe:2.3:a:oracle:retail_eftlink:20.0.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:siebel_core_-_automation:*:*:*:*:*:*:*:* ≤ 21.5
cpe:2.3:a:apache:kafka:2.7.0:*:*:*:*:*:*:*
cpe:2.3:a:apache:spark:2.4.8:*:*:*:*:*:*:*
cpe:2.3:a:apache:spark:3.0.3:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

Produits affectés

Produit	Versions
The Eclipse Foundation · Eclipse Jetty	affected 9.4.0.RC0 to 9.4.34.v20201102 ; affected 10.0.0.alpha0 to 10.0.0.beta2 ; affected 11.0.0.alpha0 to 11.0.0.beta2

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD