In Eclipse Jetty versions 9.4.0 to 9.4.56 a buffer can be incorrectly released when confronted with a gzip error when inflating a request body. This can result in corrupted and/or inadvertent sharing of data between requests.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2025:15643 advisory.

    Red Hat Satellite is a system management solution that allows organizations     to configure and maintain their systems without the necessity to provide     public Internet access to their servers or other client systems. It     performs provisioning and configuration management of predefined standard     operating environments.

    Security Fix(es):

    * Jetty: Gzip Request Body Buffer Corruption (CVE-2024-13009)

    Users of Red Hat Satellite are advised to upgrade to these updated     packages, which fix these bugs.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In Eclipse Jetty versions 9.4.0 to 9.4.56 a buffer can be incorrectly released when confronted with a gzip     error when inflating a request body. This can result in corrupted and/or inadvertent sharing of data     between requests. (CVE-2024-13009)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:01738-1 advisory.

    Upgrade to version 9.4.57.v20241219

    - CVE-2024-6763: the HttpURI class does insufficient validation on the authority segment of a URI     (bsc#1231652)
    - CVE-2024-13009: Gzip Request Body Buffer (bsc#1243271)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
264489	RHEL 8 : Satellite 6.15.5.4 Async Update (Important) (RHSA-2025:15643)	Nessus	Red Hat Local Security Checks	high
244161	Linux Distros Unpatched Vulnerability : CVE-2024-13009	Nessus	Misc.	high
237536	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : jetty-minimal (SUSE-SU-2025:01738-1)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2024-13009

high

Tenable Plugins

high

high

medium