The Eclipse Foundation Eclipse Jetty

CVE-2020-27218

MEDIUM 4.8

At a glance

Source: NVD
EPSS: EPSS 8.28 % · percentile 95 (2026-10-29)
State: PUBLISHED
Published: 2020-11-28 00:00 UTC
Updated: 2024-08-04 16:11 UTC
Assigner: eclipse
NVD status: Modified

Search on…

Description

In Eclipse Jetty version 9.4.0.RC0 to 9.4.34.v20201102, 10.0.0.alpha0 to 10.0.0.beta2, and 11.0.0.alpha0 to 11.0.0.beta2, if GZIP request body inflation is enabled and requests from different clients are multiplexed onto a single connection, and if an attacker can send a request with a body that is received entirely but not consumed by the application, then a subsequent request on the same connection will see that body prepended to its body. The attacker will not see any data but may inject data into the body of the subsequent request.

Weaknesses (CWE)

CWE-226 — Sensitive Information in Resource Not Removed Before Reuse

References

Scores

Version	Score	Vector	Scored by
CVSS 3.1	MEDIUM 4.8	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L	NVD · nvd@nist.gov (Primary)
CVSS 2.0	MEDIUM 5.8	AV:N/AC:M/Au:N/C:N/I:P/A:P	NVD · nvd@nist.gov (Primary)

Advisories

GHSA-86wm-rrjm-8wh8 — Buffer not correctly recycled in Gzip Request inflation

European references

ENISA EUVD · EUVD-2020-1488
GCVE · GCVE-0-2020-27218

CERT-FR advisories

CERTFR-2023-AVI-0357 — Multiples vulnérabilités dans IBM Cognos · cert.ssi.gouv.fr
CERTFR-2021-AVI-951 — Multiples vulnérabilités dans le noyau Linux de RedHat · cert.ssi.gouv.fr

Affected configurations (NVD CPE)

cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:* ≥ 9.4.0 < 9.4.35
cpe:2.3:a:eclipse:jetty:10.0.0:alpha0:*:*:*:*:*:*
cpe:2.3:a:eclipse:jetty:10.0.0:alpha1:*:*:*:*:*:*
cpe:2.3:a:eclipse:jetty:10.0.0:beta0:*:*:*:*:*:*
cpe:2.3:a:eclipse:jetty:10.0.0:beta1:*:*:*:*:*:*
cpe:2.3:a:eclipse:jetty:10.0.0:beta2:*:*:*:*:*:*
cpe:2.3:a:eclipse:jetty:11.0.0:alpha0:*:*:*:*:*:*
cpe:2.3:a:eclipse:jetty:11.0.0:beta1:*:*:*:*:*:*
cpe:2.3:a:eclipse:jetty:11.0.0:beta2:*:*:*:*:*:*
cpe:2.3:a:netapp:oncommand_system_manager:*:*:*:*:*:*:*:* ≥ 3.0 ≤ 3.1.3
cpe:2.3:a:netapp:snap_creator_framework:-:*:*:*:*:*:*:*
cpe:2.3:a:oracle:blockchain_platform:*:*:*:*:*:*:*:* < 21.1.2
cpe:2.3:a:oracle:communications_converged_application_server_-_service_controller:6.2:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_offline_mediation_controller:12.0.0.3.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_pricing_design_center:12.0.0.3.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_services_gatekeeper:7.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_session_route_manager:*:*:*:*:*:*:*:* ≥ 8.0.0 ≤ 8.2.4
cpe:2.3:a:oracle:flexcube_private_banking:12.0.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:flexcube_private_banking:12.1.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:hyperion_infrastructure_technology:11.1.2.6.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:rest_data_services:*:*:*:*:-:*:*:* < 20.4.3.050.1904
cpe:2.3:a:oracle:retail_eftlink:20.0.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:siebel_core_-_automation:*:*:*:*:*:*:*:* ≤ 21.5
cpe:2.3:a:apache:kafka:2.7.0:*:*:*:*:*:*:*
cpe:2.3:a:apache:spark:2.4.8:*:*:*:*:*:*:*
cpe:2.3:a:apache:spark:3.0.3:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

Affected products

Product	Versions
The Eclipse Foundation · Eclipse Jetty	affected 9.4.0.RC0 to 9.4.34.v20201102 ; affected 10.0.0.alpha0 to 10.0.0.beta2 ; affected 11.0.0.alpha0 to 11.0.0.beta2

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD

🟡 The Eclipse Foundation Eclipse Jetty