Log in Start free

Vulnerability · Published Feb 26, 2021 · Assigned by eclipse

CVE-2020-27223

Medium 5.2

In plain English

A medium-severity security flaw in Eclipse Jetty from The Eclipse Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 78.0% (higher than 99.6% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.2Medium
Exploit odds (30 days)78.0%top 0.4% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling1Public PoC

Official description

In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept headers with a large number of “quality” (i.e. q) parameters, the server may enter a denial of service (DoS) state due to high CPU usage processing those quality values, resulting in minutes of CPU time exhausted processing those quality values.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12jetty99.4.38-1DEBIAN-CVE-2020-27223
Debian:13jetty99.4.38-1DEBIAN-CVE-2020-27223
Debian:14jetty99.4.38-1DEBIAN-CVE-2020-27223
Mavenorg.eclipse.jetty:jetty-server10.0.1GHSA-m394-8rww-3jr7
Mavenorg.eclipse.jetty:jetty-server11.0.1GHSA-m394-8rww-3jr7
Mavenorg.eclipse.jetty:jetty-server9.4.37GHSA-m394-8rww-3jr7
Ubuntu:22.04:LTSjetty9no fix listedUBUNTU-CVE-2020-27223

Affected products (as reported)

VendorProductVersions
The Eclipse Foundation Eclipse Jetty 9.4.6.v20170531 – before unspecifiedunspecified – through 9.4.36.v2021011410.0.011.0.0

Weakness: CWE-407 · Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H

References