In Eclipse Jetty version 9.4.0.RC0 to 9.4.34.v20201102, 10.0.0.alpha0 to 10.0.0.beta2, and 11.0.0.alpha0 to 11.0.0.beta2, if GZIP request body inflation is enabled and requests from different clients are multiplexed onto a single connection, and if an attacker can send a request with a body that is received entirely but not consumed by the application, then a subsequent request on the same connection will see that body prepended to its body. The attacker will not see any data but may inject data into the body of the subsequent request.

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:2431 advisory.

  - jetty: local temporary directory hijacking vulnerability (CVE-2020-27216)

  - jetty: buffer not correctly recycled in Gzip Request inflation (CVE-2020-27218)

  - jetty: request containing multiple Accept headers with a large number of quality parameters may lead to     DoS (CVE-2020-27223)

  - jenkins-2-plugins/config-file-provider: Does not configure its XML parser to prevent XML external entity     (XXE) attacks. (CVE-2021-21642)

  - jenkins-2-plugins/config-file-provider: Does not correctly perform permission checks in several HTTP     endpoints. (CVE-2021-21643)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Red Hat Enterprise Linux CoreOS 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:2517 advisory.

  - jetty: local temporary directory hijacking vulnerability (CVE-2020-27216)

  - jetty: buffer not correctly recycled in Gzip Request inflation (CVE-2020-27218)

  - jetty: request containing multiple Accept headers with a large number of quality parameters may lead to     DoS (CVE-2020-27223)

  - jenkins-2-plugins/config-file-provider: Does not configure its XML parser to prevent XML external entity     (XXE) attacks. (CVE-2021-21642)

  - jenkins-2-plugins/config-file-provider: Does not correctly perform permission checks in several HTTP     endpoints. (CVE-2021-21643)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Red Hat Enterprise Linux CoreOS 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2021:2499 advisory.

  - jetty: local temporary directory hijacking vulnerability (CVE-2020-27216)

  - jetty: buffer not correctly recycled in Gzip Request inflation (CVE-2020-27218)

  - jetty: request containing multiple Accept headers with a large number of quality parameters may lead to     DoS (CVE-2020-27223)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In Eclipse Jetty version 9.4.0.RC0 to 9.4.34.v20201102, 10.0.0.alpha0 to 10.0.0.beta2, and 11.0.0.alpha0     to 11.0.0.beta2, if GZIP request body inflation is enabled and requests from different clients are     multiplexed onto a single connection, and if an attacker can send a request with a body that is received     entirely but not consumed by the application, then a subsequent request on the same connection will see     that body prepended to its body. The attacker will not see any data but may inject data into the body of     the subsequent request. (CVE-2020-27218)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In Eclipse Jetty version 9.4.0.RC0 to 9.4.34.v20201102, 10.0.0.alpha0 to 10.0.0.beta2, and 11.0.0.alpha0
    to 11.0.0.beta2, if GZIP request body inflation is enabled and requests from different clients are
    multiplexed onto a single connection, and if an attacker can send a request with a body that is received
    entirely but not consumed by the application, then a subsequent request on the same connection will see
    that body prepended to its body. The attacker will not see any data but may inject data into the body of
    the subsequent request. (CVE-2020-27218)

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3641 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3641-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                      Markus Koschany     October 30, 2023                              https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : jetty9     Version        : 9.4.50-4+deb10u1     CVE ID         : CVE-2020-27218 CVE-2023-36478 CVE-2023-44487     Debian Bug     : 976211

    Two remotely exploitable security vulnerabilities were discovered in Jetty 9,     a Java based web server and servlet engine.

    The HTTP/2 protocol implementation did not sufficiently verify if HPACK header     values exceed their size limit. Furthermore the HTTP/2 protocol allowed a     denial of service (server resource consumption) because request cancellation     can reset many streams quickly. This problem is also known as Rapid Reset     Attack.

    In addition this version also addresses CVE-2020-27218.

    If GZIP request body inflation is enabled and requests from different clients     are multiplexed onto a single connection, and if an attacker can send a request     with a body that is received entirely but not consumed by the application, then     a subsequent request on the same connection will see that body prepended to its     body. The attacker will not see any data but may inject data into the body of     the subsequent request.

    For Debian 10 buster, these problems have been fixed in version     9.4.50-4+deb10u1.

    We recommend that you upgrade your jetty9 packages.

    For the detailed security status of jetty9 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/jetty9

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: This is a digitally signed message part

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Jetty installed on the remote host suffers from a flaw where the buffer is not correctly recycled in Gzip request inflation. This may permit an attacker to inject data into the body of the subsequent request

Note that the scanner has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:2431 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing     Kubernetes application platform solution designed for on-premise or private     cloud deployments.

    This advisory contains the RPM packages for Red Hat OpenShift Container     Platform 4.5.41. See the following advisory for the container images for     this release:

    https://access.redhat.com/errata/RHSA-2021:2430

    Security Fix(es):

    * jenkins-2-plugins/config-file-provider: Does not configure its XML parser to prevent XML external entity     (XXE) attacks. (CVE-2021-21642)

    * jetty: local temporary directory hijacking vulnerability (CVE-2020-27216)

    * jetty: buffer not correctly recycled in Gzip Request inflation (CVE-2020-27218)

    * jetty: request containing multiple Accept headers with a large number of quality parameters may lead     to DoS (CVE-2020-27223)

    * jenkins-2-plugins/config-file-provider: Does not correctly perform permission checks in several HTTP     endpoints. (CVE-2021-21643)

    * jenkins-2-plugins/config-file-provider: does not require POST requests for an HTTP endpoint, resulting     in a cross-site request forgery (CSRF) vulnerability. (CVE-2021-21644)

    * jenkins-2-plugins/config-file-provider: Does not perform permission checks in several HTTP endpoints.
    (CVE-2021-21645)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * Placeholder bug for OCP 4.5.41 rpm release (BZ#1972114)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:2517 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution     designed for on-premise or private cloud deployments.

    This advisory contains the RPM packages for Red Hat OpenShift Container Platform 3.11.462. See the     following advisory for the container images for this release:

    https://access.redhat.com/errata/RHBA-2021:2516

    Space precludes documenting all of the bug fixes and enhancements in this advisory. See the following     Release Notes documentation, which will be updated shortly for this release, for details about these     changes:

    https://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html

    All OpenShift Container Platform 3.11 users are advised to upgrade to these updated packages and images.

    Security Fix(es):

    * jenkins-2-plugins/config-file-provider: Does not configure its XML parser to prevent XML external entity     (XXE) attacks. (CVE-2021-21642)

    * jetty: local temporary directory hijacking vulnerability (CVE-2020-27216)

    * jetty: buffer not correctly recycled in Gzip Request inflation (CVE-2020-27218)

    * jetty: request containing multiple Accept headers with a large number of quality parameters may lead     to DoS (CVE-2020-27223)

    * jenkins-2-plugins/config-file-provider: Does not correctly perform permission checks in several HTTP     endpoints. (CVE-2021-21643)

    * jenkins-2-plugins/config-file-provider: does not require POST requests for an HTTP endpoint, resulting     in a cross-site request forgery (CSRF) vulnerability. (CVE-2021-21644)

    * jenkins-2-plugins/config-file-provider: Does not perform permission checks in several HTTP endpoints.
    (CVE-2021-21645)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2021:2499 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing     Kubernetes application platform solution designed for on-premise or private     cloud deployments.

    This advisory contains the RPM packages for Red Hat OpenShift Container     Platform 4.6.36. See the following advisory for the container images for     this release:

    https://access.redhat.com/errata/RHBA-2021:2498

    Security Fix(es):

    * jetty: local temporary directory hijacking vulnerability (CVE-2020-27216)

    * jetty: buffer not correctly recycled in Gzip Request inflation (CVE-2020-27218)

    * jetty: request containing multiple Accept headers with a large number of quality parameters may lead     to DoS (CVE-2020-27223)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for jetty-minimal fixes the following issues :

  - jetty-minimal was upgraded to version 9.4.35.v20201120

  - CVE-2020-27218: Fixed an issue where buffer not     correctly recycled in Gzip Request inflation     (bsc#1179727).

This update was imported from the SUSE:SLE-15-SP2:Update update project.

ID	Name	Product	Family	Type	Severity
312561	RHCOS 4 : OpenShift Container Platform 4.5.41 (RHSA-2021:2431)	Nessus	Red Hat Local Security Checks	Local	high
312499	RHCOS 3 : OpenShift Container Platform 3.11.462 (RHSA-2021:2517)	Nessus	Red Hat Local Security Checks	Local	high
312473	RHCOS 4 : OpenShift Container Platform 4.6.36 (RHSA-2021:2499)	Nessus	Red Hat Local Security Checks	Local	high
223460	Linux Distros Unpatched Vulnerability : CVE-2020-27218	Nessus	Misc.	Local	medium
412494	SCA: security update for org.eclipse.jetty:jetty-server (GHSA-86wm-rrjm-8wh8)	Tenable Cloud Security	SCA Checks	Local	medium
412494	SCA: security update for org.eclipse.jetty:jetty-server (GHSA-86wm-rrjm-8wh8)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
184061	Debian dla-3641 : jetty9 - security update	Nessus	Debian Local Security Checks	Local	critical
113001	Jetty 11.0.0 < 11.0.0.beta3 Information Disclosure	Web App Scanning	Component Vulnerability	Version Based	medium
113000	Jetty 10.0.0 < 10.0.0.beta3 Information Disclosure	Web App Scanning	Component Vulnerability	Version Based	medium
112999	Jetty 9.4.x < 9.4.35 Information Disclosure	Web App Scanning	Component Vulnerability	Version Based	medium
151290	RHEL 7 : OpenShift Container Platform 4.5.41 (RHSA-2021:2431)	Nessus	Red Hat Local Security Checks	Local	high
151276	RHEL 7 : OpenShift Container Platform 3.11.462 (RHSA-2021:2517)	Nessus	Red Hat Local Security Checks	Local	high
151117	RHEL 8 : OpenShift Container Platform 4.6.36 (RHSA-2021:2499)	Nessus	Red Hat Local Security Checks	Local	high
145377	openSUSE Security Update : jetty-minimal (openSUSE-2021-12)	Nessus	SuSE Local Security Checks	Local	medium

Detections

Analytics

CVE-2020-27218

medium

Tenable Plugins

high

high

high

medium

medium

medium

critical

medium

medium

medium

high

high

high

medium