PT-2020-4636 · Eclipse · Eclipse Jetty

Published 2020-07-09 · Updated 2021-06-14 · CVE-2019-17638

Positive Technologies (AI Summary)

CVSS v2.0

9.7

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:P

Name of the Vulnerable Software and Affected Versions Eclipse Jetty versions 9.4.27.v20200227 through 9.4.29.v20200521

Description The issue is related to the handling of large response headers in Eclipse Jetty, which can lead to a situation where two threads acquire the same ByteBuffer from the pool. This can result in a client seeing data from another request or response, potentially containing sensitive information such as HTTP session IDs or authentication credentials.

Recommendations For Eclipse Jetty versions 9.4.27.v20200227 through 9.4.29.v20200521, consider configuring a responseHeaderSize significantly larger than the requestHeaderSize, such as 12KB responseHeaderSize and 8KB requestHeaderSize, to reduce the vulnerability. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-672

CWE-675

Related Identifiers

BDU:2020-05188

CVE-2019-17638

GHSA-X3RH-M7VP-35F2

RHSA-2020:3808

RHSA-2020:3841

RHSA-2020:4223

Affected Products

Eclipse Jetty

References · 47

• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XE6US6VPZHOWFMUSFGDS5V2DNQPY5MKB · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-x3rh-m7vp-35f2 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/XE6US6VPZHOWFMUSFGDS5V2DNQPY5MKB · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-17638 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-17638 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-17638 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-17638 · Security Note
• https://bdu.fstec.ru/vul/2020-05188 · Security Note
• https://osv.dev/vulnerability/CVE-2019-17638 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-17638 · Vendor Advisory
• https://bugs.eclipse.org/bugs/show_bug.cgi?id=564984 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-17638 · Vendor Advisory
• https://github.com/eclipse/jetty.project/commit/ff8ae56fa939c3477a0cdd1ff56ce3d902f08fba · Note
• https://github.com/eclipse/jetty.project/issues/4936 · Note
• https://lists.apache.org/thread.html/r9a2cfa56d30782a0c17a5deb951a622d1f5c8de48e1c3b578ffc2a84%40%3Ccommits.pulsar.apache.org%3E · Note