Detections
Analytics

SCA: security update for org.eclipse.jetty:jetty-server (GHSA-x3rh-m7vp-35f2)

critical Tenable Self-Hosted Container Security Plugin ID 420260

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In Eclipse Jetty, versions 9.4.27.v20200227 to 9.4.29.v20200521, in case of too large response headers,
 Jetty throws an exception to produce an HTTP 431 error. When this happens, the ByteBuffer containing the
 HTTP response headers is released back to the ByteBufferPool twice. Because of this double release, two
 threads can acquire the same ByteBuffer from the pool and while thread1 is about to use the ByteBuffer to
 write response1 data, thread2 fills the ByteBuffer with other data. Thread1 then proceeds to write the
 buffer that now contains different data. This results in client1, which issued request1 seeing data from
 another request or response which could contain sensitive data belonging to client2 (HTTP session ids,
 authentication credentials, etc.). If the Jetty version cannot be upgraded, the vulnerability can be
 significantly reduced by configuring a responseHeaderSize significantly larger than the requestHeaderSize
 (12KB responseHeaderSize and 8KB requestHeaderSize). (CVE-2019-17638)

See Also

https://github.com/advisories/GHSA-x3rh-m7vp-35f2

Plugin Details

Severity: Critical

ID: 420260

Version: Revision 1.7

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.5

Percentile: 57.35

Vendor

Vendor Severity: Critical

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 5.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2019-17638

CVSS v3

Risk Factor: Critical

Base Score: 9.4

Temporal Score: 8.2

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 8/5/2020

Vulnerability Publication Date: 7/9/2020

Reference Information

CVE: CVE-2019-17638