PT-2020-16664 · Eclipse+3 · Eclipse Jetty+3
Published
2020-11-28
·
Updated
2024-03-06
·
CVE-2020-27218
CVSS v2.0
5.8
Medium
| Vector | AV:N/AC:M/Au:N/C:N/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
Eclipse Jetty versions 9.4.0.RC0 through 9.4.34.v20201102
Eclipse Jetty versions 10.0.0.alpha0 through 10.0.0.beta2
Eclipse Jetty versions 11.0.0.alpha0 through 11.0.0.beta2
Description
The issue occurs when GZIP request body inflation is enabled and requests from different clients are multiplexed onto a single connection. If an attacker can send a request with a body that is received entirely but not consumed by the application, then a subsequent request on the same connection will see that body prepended to its body. The attacker will not see any data but may inject data into the body of the subsequent request.
Recommendations
For Eclipse Jetty versions 9.4.0.RC0 through 9.4.34.v20201102, consider disabling compressed request body inflation by GzipHandler or always fully consuming the request content before sending a response.
For Eclipse Jetty versions 10.0.0.alpha0 through 10.0.0.beta2, consider disabling compressed request body inflation by GzipHandler or always fully consuming the request content before sending a response.
For Eclipse Jetty versions 11.0.0.alpha0 through 11.0.0.beta2, consider disabling compressed request body inflation by GzipHandler or always fully consuming the request content before sending a response.
As a temporary workaround, consider adding a
Connection: close to any response where the servlet does not fully consume request content.Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Eclipse Jetty
Suse