CVE-2020-27216: Race Condition

Published Oct 22, 2020
·
Updated

Impact On Unix like systems, the system's temporary directory is shared between all users on that system. A collocated user can observe the process of creating a temporary sub directory in the shared temporary directory and race to complete the creation of the temporary subdirectory. If the attacker wins the race then they will have read and write permission to the subdirectory used to unpack web applications, including their WEB-INF/lib jar files and JSP files. If any code is ever executed out of this temporary directory, this can lead to a local privilege escalation vulnerability.

Additionally, any user code uses of WebAppContext::getTempDirectory) would similarly be vulnerable.

Additionally, any user application code using the ServletContext attribute for the tempdir will also be impacted. See: https://javaee.github.io/javaee-spec/javadocs/javax/servlet/ServletContext.html#TEMPDIR

For example: java import java.io.File; import java.io.IOException; import javax.servlet.ServletContext; import javax.servlet.ServletException; import javax.servlet.http.HttpServlet; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse;

public class ExampleServlet extends HttpServlet { @Override protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException { File tempDir = (File)getServletContext().getAttribute(ServletContext.TEMPDIR); // Potentially compromised // do something with that temp dir } }

Example: The JSP library itself will use the container temp directory for compiling the JSP source into Java classes before executing them.

CVSSv3.1 Evaluation

This vulnerability has been calculated to have a CVSSv3.1 score of 7.8/10 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Patches Fixes were applied to the 9.4.x branch with: - https://github.com/eclipse/jetty.project/commit/53e0e0e9b25a6309bf24ee3b10984f4145701edb - https://github.com/eclipse/jetty.project/commit/9ad6beb80543b392c91653f6bfce233fc75b9d5f

These will be included in releases: 9.4.33, 10.0.0.beta3, 11.0.0.beta3

Workarounds

A work around is to set a temporary directory, either for the server or the context, to a directory outside of the shared temporary file system. For recent releases, a temporary directory can be created simple by creating a directory called work in the ${jetty.base} directory (the parent directory of the webapps directory). Alternately the java temporary directory can be set with the System Property java.io.tmpdir. A more detailed description of how jetty selects a temporary directory is below.

The Jetty search order for finding a temporary directory is as follows:

1. If the WebAppContext has a temp directory specified), use it. 2. If the ServletContext has the javax.servlet.context.tempdir attribute set, and if directory exists, use it. 3. If a ${jetty.base}/work directory exists, use it (since Jetty 9.1) 4. If a ServletContext has the org.eclipse.jetty.webapp.basetempdir attribute set, and if the directory exists, use it. 5. Use System.getProperty("java.io.tmpdir") and use it.

Jetty will end traversal at the first successful step. To mitigate this vulnerability the directory must be set to one that is not writable by an attacker. To avoid information leakage, the directory should also not be readable by an attacker.

Setting a Jetty server temporary directory.

Choices 3 and 5 apply to the server level, and will impact all deployed webapps on the server.

For choice 3 just create that work directory underneath your ${jetty.base} and restart Jetty.

For choice 5, just specify your own java.io.tmpdir when you start the JVM for Jetty.

shell [jetty-distribution]$ java -Djava.io.tmpdir=/var/web/work -jar start.jar

Setting a Context specific temporary directory.

The rest of the choices require you to configure the context for that deployed webapp (seen as ${jetty.base}/webapps/<context>.xml)

Example (excluding the DTD which is version specific):

xml <Configure class="org.eclipse.jetty.webapp.WebAppContext"> <Set name="contextPath"><Property name="foo"/></Set> <Set name="war">/var/web/webapps/foo.war</Set> <Set name="tempDirectory">/var/web/work/foo</Set> </Configure>

References - https://github.com/eclipse/jetty.project/issues/5451 - CWE-378: Creation of Temporary File With Insecure Permissions - CWE-379: Creation of Temporary File in Directory with Insecure Permissions - CodeQL Query PR To Detect Similar Vulnerabilities

Similar Vulnerabilities

Similar, but not the same.

- JUnit 4 - https://github.com/junit-team/junit4/security/advisories/GHSA-269g-pwp5-87pp - Google Guava - https://github.com/google/guava/issues/4011 - Apache Ant - https://nvd.nist.gov/vuln/detail/CVE-2020-1945 - JetBrains Kotlin Compiler - https://nvd.nist.gov/vuln/detail/CVE-2020-15824

For more information

The original report of this vulnerability is below:

> On Thu, 15 Oct 2020 at 21:14, Jonathan Leitschuh <jonathan.leitschuh@gmail.com> wrote: > Hi WebTide Security Team, > > I'm a security researcher writing some custom CodeQL queries to find Local Temporary Directory Hijacking Vulnerabilities. One of my queries flagged an issue in Jetty. > > https://lgtm.com/query/5615014766184643449/ > > I've recently been looking into security vulnerabilities involving the temporary directory because on unix-like systems, the system temporary directory is shared between all users. > There exists a race condition between the deletion of the temporary file and the creation of the directory. > > java > // ensure file will always be unique by appending random digits > tmpDir = File.createTempFile(temp, ".dir", parent); // Attacker knows the full path of the file that will be generated > // delete the file that was created > tmpDir.delete(); // Attacker sees file is deleted and begins a race to create their own directory before Jetty. > // and make a directory of the same name > // SECURITY VULNERABILITY: Race Condition! - Attacker beats Jetty and now owns this directory > tmpDir.mkdirs(); > > > https://github.com/eclipse/jetty.project/blob/1b59672b7f668b8a421690154b98b4b2b03f254b/jetty-webapp/src/main/java/org/eclipse/jetty/webapp/WebInfConfiguration.java#L511-L518 > > In several cases the parent parameter will not be the system temporary directory. However, there is one case where it will be, as the last fallback. > > > https://github.com/eclipse/jetty.project/blob/1b59672b7f668b8a421690154b98b4b2b03f254b/jetty-webapp/src/main/java/org/eclipse/jetty/webapp/WebInfConfiguration.java#L467-L468 > > If any code is ever executed out of this temporary directory, this can lead to a local privilege escalation vulnerability. > > Would your team be willing to open a GitHub security advisory to continue the discussion and disclosure there? https://github.com/eclipse/jetty.project/security/advisories > > This vulnerability disclosure follows Google's 90-day vulnerability disclosure policy (I'm not an employee of Google, I just like their policy). Full disclosure will occur either at the end of the 90-day deadline or whenever a patch is made widely available, whichever occurs first. > > Cheers, > Jonathan Leitschuh

Other sources

In Eclipse Jetty versions 1.0 thru 9.4.32.v20200930, 10.0.0.alpha1 thru 10.0.0.beta2, and 11.0.0.alpha1 thru 11.0.0.beta2O, on Unix like systems, the system's temporary directory is shared between all users on that system. A collocated user can observe the process of creating a temporary sub directory in the shared temporary directory and race to complete the creation of the temporary subdirectory. If the attacker wins the race then they will have read and write permission to the subdirectory used to unpack web applications, including their WEB-INF/lib jar files and JSP files. If any code is ever executed out of this temporary directory, this can lead to a local privilege escalation vulnerability.

Affected Software

115 affected componentsFixes available
redhat/rh-eclipse<1:4.17-6.el7_9
1:4.17-6.el7_9
redhat/rh-eclipse-ant<0:1.10.9-1.2.el7
0:1.10.9-1.2.el7
redhat/rh-eclipse-antlr32<0:3.2-28.1.el7
0:3.2-28.1.el7
redhat/rh-eclipse-apache-sshd<1:2.4.0-5.1.el7
1:2.4.0-5.1.el7
redhat/rh-eclipse-apiguardian<0:1.1.0-6.1.el7
0:1.1.0-6.1.el7
redhat/rh-eclipse-args4j<0:2.33-12.2.el7
0:2.33-12.2.el7
redhat/rh-eclipse-batik<0:1.13-1.1.el7
0:1.13-1.1.el7
redhat/rh-eclipse-bouncycastle<0:1.67-1.1.el7
0:1.67-1.1.el7
redhat/rh-eclipse-cbi-plugins<0:1.1.7-8.1.el7
0:1.1.7-8.1.el7
redhat/rh-eclipse-decentxml<0:1.4-24.1.el7
0:1.4-24.1.el7
redhat/rh-eclipse-ecj<1:4.17-1.1.el7
1:4.17-1.1.el7
redhat/rh-eclipse-eclipse<1:4.17-2.2.el7_9
1:4.17-2.2.el7_9
redhat/rh-eclipse-eclipse-ecf<0:3.14.17-1.1.el7
0:3.14.17-1.1.el7
redhat/rh-eclipse-eclipse-egit<0:5.9.0-1.1.el7_9
0:5.9.0-1.1.el7_9
redhat/rh-eclipse-eclipse-emf<1:2.23.0-1.1.el7
1:2.23.0-1.1.el7
redhat/rh-eclipse-eclipse-gef<0:3.11.0-14.1.el7
0:3.11.0-14.1.el7
redhat/rh-eclipse-eclipse-jgit<0:5.9.0-1.1.el7_9
0:5.9.0-1.1.el7_9
redhat/rh-eclipse-eclipse-license<0:2.0.2-2.1.el7_9
0:2.0.2-2.1.el7_9
redhat/rh-eclipse-eclipse-m2e-core<0:1.16.2-3.1.el7_9
0:1.16.2-3.1.el7_9
redhat/rh-eclipse-eclipse-m2e-workspace<0:0.4.0-16.1.el7
0:0.4.0-16.1.el7
redhat/rh-eclipse-eclipse-mpc<0:1.8.4-1.1.el7
0:1.8.4-1.1.el7
redhat/rh-eclipse-eclipse-pydev<1:8.0.0-1.1.el7_9
1:8.0.0-1.1.el7_9
redhat/rh-eclipse-eclipse-subclipse<0:4.3.0-8.1.el7_9
0:4.3.0-8.1.el7_9
redhat/rh-eclipse-eclipse-webtools<0:3.19.0-1.1.el7_9
0:3.19.0-1.1.el7_9
redhat/rh-eclipse-ed25519-java<0:0.3.0-8.2.el7
0:0.3.0-8.2.el7
redhat/rh-eclipse-felix-gogo-command<0:1.0.2-12.1.el7
0:1.0.2-12.1.el7
redhat/rh-eclipse-felix-gogo-parent<0:4-6.1.el7
0:4-6.1.el7
redhat/rh-eclipse-felix-gogo-runtime<0:1.1.0-8.1.el7
0:1.1.0-8.1.el7
redhat/rh-eclipse-felix-gogo-shell<0:1.1.0-6.1.el7
0:1.1.0-6.1.el7
redhat/rh-eclipse-felix-scr<0:2.1.16-7.2.el7
0:2.1.16-7.2.el7
redhat/rh-eclipse-javaewah<0:1.1.6-10.1.el7
0:1.1.6-10.1.el7
redhat/rh-eclipse-javaparser<0:3.14.16-1.2.el7
0:3.14.16-1.2.el7
redhat/rh-eclipse-jchardet<0:1.1-23.1.el7
0:1.1-23.1.el7
redhat/rh-eclipse-jctools<0:3.1.0-1.1.el7
0:3.1.0-1.1.el7
redhat/rh-eclipse-jetty<0:9.4.33-1.1.el7
0:9.4.33-1.1.el7
redhat/rh-eclipse-jffi<0:1.2.23-2.1.el7
0:1.2.23-2.1.el7
redhat/rh-eclipse-jgit<0:5.9.0-1.2.el7
0:5.9.0-1.2.el7
redhat/rh-eclipse-jna<0:5.4.0-7.1.el7
0:5.4.0-7.1.el7
redhat/rh-eclipse-jnr-constants<0:0.9.12-7.1.el7
0:0.9.12-7.1.el7
redhat/rh-eclipse-jnr-ffi<0:2.1.8-9.1.el7
0:2.1.8-9.1.el7
redhat/rh-eclipse-jnr-netdb<0:1.1.6-11.1.el7
0:1.1.6-11.1.el7
redhat/rh-eclipse-jnr-posix<0:3.0.47-7.1.el7
0:3.0.47-7.1.el7
redhat/rh-eclipse-jnr-x86asm<0:1.0.2-22.1.el7
0:1.0.2-22.1.el7
redhat/rh-eclipse-jsch-agent-proxy<0:0.0.8-14.1.el7
0:0.0.8-14.1.el7
redhat/rh-eclipse-junit5<0:5.7.0-1.2.el7
0:5.7.0-1.2.el7
redhat/rh-eclipse-jython<0:2.7.1-14.1.el7_9
0:2.7.1-14.1.el7_9
redhat/rh-eclipse-jzlib<0:1.1.3-15.1.el7
0:1.1.3-15.1.el7
redhat/rh-eclipse-lucene<0:8.6.3-1.1.el7
0:8.6.3-1.1.el7
redhat/rh-eclipse-maven-archetype<0:3.2.0-1.1.el7_9
0:3.2.0-1.1.el7_9
redhat/rh-eclipse-maven-indexer<0:6.0.0-5.1.el7
0:6.0.0-5.1.el7
redhat/rh-eclipse-netty<0:4.1.51-1.2.el7
0:4.1.51-1.2.el7
redhat/rh-eclipse-objectweb-asm<0:8.0.1-1.2.el7
0:8.0.1-1.2.el7
redhat/rh-eclipse-opentest4j<0:1.2.0-4.1.el7
0:1.2.0-4.1.el7
redhat/rh-eclipse-os-maven-plugin<0:1.6.2-2.1.el7
0:1.6.2-2.1.el7
redhat/rh-eclipse-sac<0:1.3-34.1.el7
0:1.3-34.1.el7
redhat/rh-eclipse-sat4j<0:2.3.5-20.1.el7
0:2.3.5-20.1.el7
redhat/rh-eclipse-sequence-library<0:1.0.3-8.1.el7
0:1.0.3-8.1.el7
redhat/rh-eclipse-sqljet<0:1.1.10-18.1.el7
0:1.1.10-18.1.el7
redhat/rh-eclipse-stringtemplate<0:3.2.1-24.1.el7
0:3.2.1-24.1.el7
redhat/rh-eclipse-svnkit<1:1.8.12-9.1.el7
1:1.8.12-9.1.el7
redhat/rh-eclipse-takari-polyglot<0:0.4.5-2.1.el7_9
0:0.4.5-2.1.el7_9
redhat/rh-eclipse-trilead-ssh2<0:217.21-3.1.el7
0:217.21-3.1.el7
redhat/rh-eclipse-tycho<0:1.7.0-2.5.el7_9
0:1.7.0-2.5.el7_9
redhat/rh-eclipse-univocity-parsers<0:2.9.0-1.1.el7
0:2.9.0-1.1.el7
redhat/rh-eclipse-ws-commons-util<0:1.0.2-14.1.el7
0:1.0.2-14.1.el7
redhat/rh-eclipse-xmlgraphics-commons<0:2.4-1.1.el7
0:2.4-1.1.el7
redhat/rh-eclipse-xml-maven-plugin<0:1.0.2-7.1.el7
0:1.0.2-7.1.el7
redhat/rh-eclipse-xmlrpc<1:3.1.3-27.1.el7
1:3.1.3-27.1.el7
redhat/jenkins<0:2.289.1.1624365627-1.el7
0:2.289.1.1624365627-1.el7
redhat/jenkins<0:2.277.3.1623846768-1.el7
0:2.277.3.1623846768-1.el7
redhat/jenkins<0:2.277.3.1623853726-1.el8
0:2.277.3.1623853726-1.el8
maven/org.eclipse.jetty:jetty-webapp<9.4.33.v20201020
9.4.33.v20201020
maven/org.mortbay.jetty:jetty-webapp>=11.0.0.beta1<=11.0.0.beta2
11.0.0.beta3
maven/org.eclipse.jetty:jetty-webapp>=11.0.0.beta1<=11.0.0.beta2
11.0.0.beta3
maven/org.mortbay.jetty:jetty-webapp>=10.0.0.beta1<=10.0.0.beta2
10.0.0.beta3
maven/org.eclipse.jetty:jetty-webapp>=10.0.0.beta1<=10.0.0.beta2
10.0.0.beta3
maven/org.mortbay.jetty:jetty-webapp<9.4.33
9.4.33
debian/jetty9
9.4.16-0+deb10u19.4.50-4+deb10u19.4.39-3+deb11u29.4.50-4+deb11u19.4.50-4+deb12u29.4.53-1
Eclipse Jetty>=1.0<9.3.29
Eclipse Jetty>=9.4.0<=9.4.32
Eclipse Jetty=10.0.0-alpha1
Eclipse Jetty=10.0.0-beta0
Eclipse Jetty=10.0.0-beta1
Eclipse Jetty=10.0.0-beta2
Eclipse Jetty=11.0.0-alpha1
Eclipse Jetty=11.0.0-beta1
Eclipse Jetty=11.0.0-beta2
NetApp Snap Creator Framework
NetApp Snapcenter
NetApp Vasa Provider Clustered Data Ontap>=7.2
NetApp Virtual Storage Console Vmware Vsphere>=7.2
NetApp Storage Replication Adapter Clustered Data Ontap>=7.2
VMware vSphere
Oracle Communications Application Session Controller=3.9m0p2
Oracle Communications Converged Application Server - Service Controller=6.2
Oracle Communications Element Manager>=8.2.1<=8.2.2.1
Oracle Communications Offline Mediation Controller=12.0.0.3.0
Oracle Communications Pricing Design Center=12.0.0.3.0
Oracle Communications Services Gatekeeper=7.0
Oracle FLEXCUBE Core Banking>=11.5.0<=11.9.0
Oracle FLEXCUBE Private Banking=12.0.0
Oracle FLEXCUBE Private Banking=12.1.0
Oracle JD Edwards EnterpriseOne Tools<9.2.6.0
Oracle Siebel Core - Automation<=21.5
Apache Beam=2.21.0
Apache Beam=2.22.0
Apache Beam=2.23.0
Apache Beam=2.24.0
Apache Beam=2.25.0
Debian Debian Linux=9.0
Debian Debian Linux=10.0
redhat/jetty<9.4.33.
9.4.33.
redhat/jetty<10.0.0.
10.0.0.
redhat/jetty<11.0.0.
11.0.0.
IBM IBM® Db2® on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data<=v4.8 v5.0v5.1v5.2v5.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade redhat/rh-eclipse to a version that resolves this vulnerability.

    Fixed in 1:4.17-6.el7_9
  2. Upgrade

    Upgrade redhat/rh-eclipse-ant to a version that resolves this vulnerability.

    Fixed in 0:1.10.9-1.2.el7
  3. Upgrade

    Upgrade redhat/rh-eclipse-antlr32 to a version that resolves this vulnerability.

    Fixed in 0:3.2-28.1.el7
  4. Upgrade

    Upgrade redhat/rh-eclipse-apache-sshd to a version that resolves this vulnerability.

    Fixed in 1:2.4.0-5.1.el7
  5. Upgrade

    Upgrade redhat/rh-eclipse-apiguardian to a version that resolves this vulnerability.

    Fixed in 0:1.1.0-6.1.el7
  6. Upgrade

    Upgrade redhat/rh-eclipse-args4j to a version that resolves this vulnerability.

    Fixed in 0:2.33-12.2.el7
  7. Upgrade

    Upgrade redhat/rh-eclipse-batik to a version that resolves this vulnerability.

    Fixed in 0:1.13-1.1.el7
  8. Upgrade

    Upgrade redhat/rh-eclipse-bouncycastle to a version that resolves this vulnerability.

    Fixed in 0:1.67-1.1.el7
  9. Upgrade

    Upgrade redhat/rh-eclipse-cbi-plugins to a version that resolves this vulnerability.

    Fixed in 0:1.1.7-8.1.el7
  10. Upgrade

    Upgrade redhat/rh-eclipse-decentxml to a version that resolves this vulnerability.

    Fixed in 0:1.4-24.1.el7
  11. Upgrade

    Upgrade redhat/rh-eclipse-ecj to a version that resolves this vulnerability.

    Fixed in 1:4.17-1.1.el7
  12. Upgrade

    Upgrade redhat/rh-eclipse-eclipse to a version that resolves this vulnerability.

    Fixed in 1:4.17-2.2.el7_9
  13. Upgrade

    Upgrade redhat/rh-eclipse-eclipse-ecf to a version that resolves this vulnerability.

    Fixed in 0:3.14.17-1.1.el7
  14. Upgrade

    Upgrade redhat/rh-eclipse-eclipse-egit to a version that resolves this vulnerability.

    Fixed in 0:5.9.0-1.1.el7_9
  15. Upgrade

    Upgrade redhat/rh-eclipse-eclipse-emf to a version that resolves this vulnerability.

    Fixed in 1:2.23.0-1.1.el7
  16. Upgrade

    Upgrade redhat/rh-eclipse-eclipse-gef to a version that resolves this vulnerability.

    Fixed in 0:3.11.0-14.1.el7
  17. Upgrade

    Upgrade redhat/rh-eclipse-eclipse-jgit to a version that resolves this vulnerability.

    Fixed in 0:5.9.0-1.1.el7_9
  18. Upgrade

    Upgrade redhat/rh-eclipse-eclipse-license to a version that resolves this vulnerability.

    Fixed in 0:2.0.2-2.1.el7_9
  19. Upgrade

    Upgrade redhat/rh-eclipse-eclipse-m2e-core to a version that resolves this vulnerability.

    Fixed in 0:1.16.2-3.1.el7_9
  20. Upgrade

    Upgrade redhat/rh-eclipse-eclipse-m2e-workspace to a version that resolves this vulnerability.

    Fixed in 0:0.4.0-16.1.el7
  21. Upgrade

    Upgrade redhat/rh-eclipse-eclipse-mpc to a version that resolves this vulnerability.

    Fixed in 0:1.8.4-1.1.el7
  22. Upgrade

    Upgrade redhat/rh-eclipse-eclipse-pydev to a version that resolves this vulnerability.

    Fixed in 1:8.0.0-1.1.el7_9
  23. Upgrade

    Upgrade redhat/rh-eclipse-eclipse-subclipse to a version that resolves this vulnerability.

    Fixed in 0:4.3.0-8.1.el7_9
  24. Upgrade

    Upgrade redhat/rh-eclipse-eclipse-webtools to a version that resolves this vulnerability.

    Fixed in 0:3.19.0-1.1.el7_9
  25. Upgrade

    Upgrade redhat/rh-eclipse-ed25519-java to a version that resolves this vulnerability.

    Fixed in 0:0.3.0-8.2.el7
  26. Upgrade

    Upgrade redhat/rh-eclipse-felix-gogo-command to a version that resolves this vulnerability.

    Fixed in 0:1.0.2-12.1.el7
  27. Upgrade

    Upgrade redhat/rh-eclipse-felix-gogo-parent to a version that resolves this vulnerability.

    Fixed in 0:4-6.1.el7
  28. Upgrade

    Upgrade redhat/rh-eclipse-felix-gogo-runtime to a version that resolves this vulnerability.

    Fixed in 0:1.1.0-8.1.el7
  29. Upgrade

    Upgrade redhat/rh-eclipse-felix-gogo-shell to a version that resolves this vulnerability.

    Fixed in 0:1.1.0-6.1.el7
  30. Upgrade

    Upgrade redhat/rh-eclipse-felix-scr to a version that resolves this vulnerability.

    Fixed in 0:2.1.16-7.2.el7
  31. Upgrade

    Upgrade redhat/rh-eclipse-javaewah to a version that resolves this vulnerability.

    Fixed in 0:1.1.6-10.1.el7
  32. Upgrade

    Upgrade redhat/rh-eclipse-javaparser to a version that resolves this vulnerability.

    Fixed in 0:3.14.16-1.2.el7
  33. Upgrade

    Upgrade redhat/rh-eclipse-jchardet to a version that resolves this vulnerability.

    Fixed in 0:1.1-23.1.el7
  34. Upgrade

    Upgrade redhat/rh-eclipse-jctools to a version that resolves this vulnerability.

    Fixed in 0:3.1.0-1.1.el7
  35. Upgrade

    Upgrade redhat/rh-eclipse-jetty to a version that resolves this vulnerability.

    Fixed in 0:9.4.33-1.1.el7
  36. Upgrade

    Upgrade redhat/rh-eclipse-jffi to a version that resolves this vulnerability.

    Fixed in 0:1.2.23-2.1.el7
  37. Upgrade

    Upgrade redhat/rh-eclipse-jgit to a version that resolves this vulnerability.

    Fixed in 0:5.9.0-1.2.el7
  38. Upgrade

    Upgrade redhat/rh-eclipse-jna to a version that resolves this vulnerability.

    Fixed in 0:5.4.0-7.1.el7
  39. Upgrade

    Upgrade redhat/rh-eclipse-jnr-constants to a version that resolves this vulnerability.

    Fixed in 0:0.9.12-7.1.el7
  40. Upgrade

    Upgrade redhat/rh-eclipse-jnr-ffi to a version that resolves this vulnerability.

    Fixed in 0:2.1.8-9.1.el7
  41. Upgrade

    Upgrade redhat/rh-eclipse-jnr-netdb to a version that resolves this vulnerability.

    Fixed in 0:1.1.6-11.1.el7
  42. Upgrade

    Upgrade redhat/rh-eclipse-jnr-posix to a version that resolves this vulnerability.

    Fixed in 0:3.0.47-7.1.el7
  43. Upgrade

    Upgrade redhat/rh-eclipse-jnr-x86asm to a version that resolves this vulnerability.

    Fixed in 0:1.0.2-22.1.el7
  44. Upgrade

    Upgrade redhat/rh-eclipse-jsch-agent-proxy to a version that resolves this vulnerability.

    Fixed in 0:0.0.8-14.1.el7
  45. Upgrade

    Upgrade redhat/rh-eclipse-junit5 to a version that resolves this vulnerability.

    Fixed in 0:5.7.0-1.2.el7
  46. Upgrade

    Upgrade redhat/rh-eclipse-jython to a version that resolves this vulnerability.

    Fixed in 0:2.7.1-14.1.el7_9
  47. Upgrade

    Upgrade redhat/rh-eclipse-jzlib to a version that resolves this vulnerability.

    Fixed in 0:1.1.3-15.1.el7
  48. Upgrade

    Upgrade redhat/rh-eclipse-lucene to a version that resolves this vulnerability.

    Fixed in 0:8.6.3-1.1.el7
  49. Upgrade

    Upgrade redhat/rh-eclipse-maven-archetype to a version that resolves this vulnerability.

    Fixed in 0:3.2.0-1.1.el7_9
  50. Upgrade

    Upgrade redhat/rh-eclipse-maven-indexer to a version that resolves this vulnerability.

    Fixed in 0:6.0.0-5.1.el7
  51. Upgrade

    Upgrade redhat/rh-eclipse-netty to a version that resolves this vulnerability.

    Fixed in 0:4.1.51-1.2.el7
  52. Upgrade

    Upgrade redhat/rh-eclipse-objectweb-asm to a version that resolves this vulnerability.

    Fixed in 0:8.0.1-1.2.el7
  53. Upgrade

    Upgrade redhat/rh-eclipse-opentest4j to a version that resolves this vulnerability.

    Fixed in 0:1.2.0-4.1.el7
  54. Upgrade

    Upgrade redhat/rh-eclipse-os-maven-plugin to a version that resolves this vulnerability.

    Fixed in 0:1.6.2-2.1.el7
  55. Upgrade

    Upgrade redhat/rh-eclipse-sac to a version that resolves this vulnerability.

    Fixed in 0:1.3-34.1.el7
  56. Upgrade

    Upgrade redhat/rh-eclipse-sat4j to a version that resolves this vulnerability.

    Fixed in 0:2.3.5-20.1.el7
  57. Upgrade

    Upgrade redhat/rh-eclipse-sequence-library to a version that resolves this vulnerability.

    Fixed in 0:1.0.3-8.1.el7
  58. Upgrade

    Upgrade redhat/rh-eclipse-sqljet to a version that resolves this vulnerability.

    Fixed in 0:1.1.10-18.1.el7
  59. Upgrade

    Upgrade redhat/rh-eclipse-stringtemplate to a version that resolves this vulnerability.

    Fixed in 0:3.2.1-24.1.el7
  60. Upgrade

    Upgrade redhat/rh-eclipse-svnkit to a version that resolves this vulnerability.

    Fixed in 1:1.8.12-9.1.el7
  61. Upgrade

    Upgrade redhat/rh-eclipse-takari-polyglot to a version that resolves this vulnerability.

    Fixed in 0:0.4.5-2.1.el7_9
  62. Upgrade

    Upgrade redhat/rh-eclipse-trilead-ssh2 to a version that resolves this vulnerability.

    Fixed in 0:217.21-3.1.el7
  63. Upgrade

    Upgrade redhat/rh-eclipse-tycho to a version that resolves this vulnerability.

    Fixed in 0:1.7.0-2.5.el7_9
  64. Upgrade

    Upgrade redhat/rh-eclipse-univocity-parsers to a version that resolves this vulnerability.

    Fixed in 0:2.9.0-1.1.el7
  65. Upgrade

    Upgrade redhat/rh-eclipse-ws-commons-util to a version that resolves this vulnerability.

    Fixed in 0:1.0.2-14.1.el7
  66. Upgrade

    Upgrade redhat/rh-eclipse-xmlgraphics-commons to a version that resolves this vulnerability.

    Fixed in 0:2.4-1.1.el7
  67. Upgrade

    Upgrade redhat/rh-eclipse-xml-maven-plugin to a version that resolves this vulnerability.

    Fixed in 0:1.0.2-7.1.el7
  68. Upgrade

    Upgrade redhat/rh-eclipse-xmlrpc to a version that resolves this vulnerability.

    Fixed in 1:3.1.3-27.1.el7
  69. Upgrade

    Upgrade redhat/jenkins to a version that resolves this vulnerability.

    Fixed in 0:2.289.1.1624365627-1.el7
  70. Upgrade

    Upgrade redhat/jenkins to a version that resolves this vulnerability.

    Fixed in 0:2.277.3.1623846768-1.el7
  71. Upgrade

    Upgrade redhat/jenkins to a version that resolves this vulnerability.

    Fixed in 0:2.277.3.1623853726-1.el8
  72. Upgrade

    Upgrade maven/org.eclipse.jetty:jetty-webapp to a version that resolves this vulnerability.

    Fixed in 9.4.33.v20201020
  73. Upgrade

    Upgrade maven/org.mortbay.jetty:jetty-webapp to a version that resolves this vulnerability.

    Fixed in 11.0.0.beta3
  74. Upgrade

    Upgrade maven/org.eclipse.jetty:jetty-webapp to a version that resolves this vulnerability.

    Fixed in 11.0.0.beta3
  75. Upgrade

    Upgrade maven/org.mortbay.jetty:jetty-webapp to a version that resolves this vulnerability.

    Fixed in 10.0.0.beta3
  76. Upgrade

    Upgrade maven/org.eclipse.jetty:jetty-webapp to a version that resolves this vulnerability.

    Fixed in 10.0.0.beta3
  77. Upgrade

    Upgrade maven/org.mortbay.jetty:jetty-webapp to a version that resolves this vulnerability.

    Fixed in 9.4.33
  78. Upgrade

    Upgrade debian/jetty9 to a version that resolves this vulnerability.

    Fixed in 9.4.16-0+deb10u1Fixed in 9.4.50-4+deb10u1Fixed in 9.4.39-3+deb11u2Fixed in 9.4.50-4+deb11u1Fixed in 9.4.50-4+deb12u2Fixed in 9.4.53-1
  79. Upgrade

    Upgrade redhat/jetty to a version that resolves this vulnerability.

    Fixed in 9.4.33.
  80. Upgrade

    Upgrade redhat/jetty to a version that resolves this vulnerability.

    Fixed in 10.0.0.
  81. Upgrade

    Upgrade redhat/jetty to a version that resolves this vulnerability.

    Fixed in 11.0.0.
  82. Upgrade

    Upgrade debian/jetty9 to a version that resolves this vulnerability.

    Fixed in 9.4.16-0+deb10u1
  83. Upgrade

    Upgrade debian/jetty9 to a version that resolves this vulnerability.

    Fixed in 9.4.50-4+deb10u1
  84. Upgrade

    Upgrade debian/jetty9 to a version that resolves this vulnerability.

    Fixed in 9.4.39-3+deb11u2
  85. Upgrade

    Upgrade debian/jetty9 to a version that resolves this vulnerability.

    Fixed in 9.4.50-4+deb11u1
  86. Upgrade

    Upgrade debian/jetty9 to a version that resolves this vulnerability.

    Fixed in 9.4.50-4+deb12u2
  87. Upgrade

    Upgrade debian/jetty9 to a version that resolves this vulnerability.

    Fixed in 9.4.53-1
  88. Configuration

    Create a directory named 'work' under your ${jetty.base} (the parent of the webapps directory) and restart Jetty so Jetty will use this directory as its work directory.

    Jetty (server) work directory presence = create ${jetty.base}/work
  89. Configuration

    Start the JVM for Jetty with -Djava.io.tmpdir=/var/web/work to force Jetty to use a temp directory outside the shared system /tmp.

    JVM / Jetty startup java.io.tmpdir = /var/web/work
  90. Configuration

    Set the WebAppContext tempDirectory in the context XML (e.g. <Set name="tempDirectory">/var/web/work/foo</Set>) to a directory outside the shared /tmp for that deployed webapp.

    WebAppContext tempDirectory = /var/web/work/foo
  91. Configuration

    Set the ServletContext attribute 'org.eclipse.jetty.webapp.basetempdir' to a path outside the shared /tmp and ensure the directory exists; Jetty will use it if present.

    ServletContext org.eclipse.jetty.webapp.basetempdir = existing directory path outside /tmp
  92. Configuration

    Ensure the 'javax.servlet.context.tempdir' ServletContext attribute points to a directory outside the shared /tmp and that the directory exists and is not writable/readable by untrusted users.

    ServletContext javax.servlet.context.tempdir = existing directory path outside /tmp
  93. Configuration

    Ensure any temp directory used by Jetty (e.g. ${jetty.base}/work or the path set via java.io.tmpdir) is owned by the service user and permissions are set so it is not readable or writable by other unprivileged users.

    Temporary directory permissions = not readable or writable by attackers

Event History

Oct 22, 2020
CVE Published
12:00 AM
Oct 23, 2020
CVE Published
via MITRE·12:05 AM
Data Sourced
via MITRE·12:05 AM
DescriptionWeakness
Data Sourced
via Red Hat·08:49 PM
DescriptionSeverityAffected Software
Nov 4, 2020
Advisory Published
05:50 PM
Jun 19, 2026
Data Sourced
via IBM·12:00 AM
DescriptionAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2020-27216?

CVE-2020-27216 is classified as a medium severity vulnerability.

2

How do I fix CVE-2020-27216?

To fix CVE-2020-27216, upgrade to the appropriate patched version of the affected software packages listed in the advisory.

3

Which software is affected by CVE-2020-27216?

CVE-2020-27216 affects multiple versions of Eclipse Jetty and related packages.

4

What is the exploit type of CVE-2020-27216?

CVE-2020-27216 is a race condition vulnerability that can lead to unauthorized access.

5

Is CVE-2020-27216 a remotely exploitable vulnerability?

Yes, CVE-2020-27216 can potentially be exploited by a collocated user on a Unix-like system.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203