Log in Start free

Vulnerability · Published Nov 28, 2020 · Assigned by eclipse

CVE-2020-27218

Medium 4.8

In plain English

A medium-severity security flaw in Eclipse Jetty from The Eclipse Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 8.3% (higher than 95% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)4.8Medium
Exploit odds (30 days)8.3%top 5.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

In Eclipse Jetty version 9.4.0.RC0 to 9.4.34.v20201102, 10.0.0.alpha0 to 10.0.0.beta2, and 11.0.0.alpha0 to 11.0.0.beta2, if GZIP request body inflation is enabled and requests from different clients are multiplexed onto a single connection, and if an attacker can send a request with a body that is received entirely but not consumed by the application, then a subsequent request on the same connection will see that body prepended to its body. The attacker will not see any data but may inject data into the body of the subsequent request.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12jetty99.4.35-1DEBIAN-CVE-2020-27218
Debian:13jetty99.4.35-1DEBIAN-CVE-2020-27218
Debian:14jetty99.4.35-1DEBIAN-CVE-2020-27218
Mavenorg.eclipse.jetty:jetty-server9.4.35.v20201120GHSA-86wm-rrjm-8wh8

Affected products (as reported)

VendorProductVersions
The Eclipse Foundation Eclipse Jetty 9.4.0.RC0 to 9.4.34.v2020110210.0.0.alpha0 to 10.0.0.beta211.0.0.alpha0 to 11.0.0.beta2

Weakness: CWE-226

References