CVE-2020-27218: Medium severity Eclipse Jetty vulnerability
Impact If GZIP request body inflation is enabled and requests from different clients are multiplexed onto a single connection and if an attacker can send a request with a body that is received entirely by not consumed by the application, then a subsequent request on the same connection will see that body prepended to it's body.
The attacker will not see any data, but may inject data into the body of the subsequent request
CVE score is 4.8 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
Workarounds The problem can be worked around by either: - Disabling compressed request body inflation by GzipHandler. - By always fully consuming the request content before sending a response. - By adding a Connection: close to any response where the servlet does not fully consume request content.
Other sources
Eclipse Jetty could allow a remote attacker to bypass security restrictions, caused by a flaw when GZIP request body inflation is enabled. By sending a specially-crafted request, an attacker could exploit this vulnerability to inject data into the body of the subsequent request.
— IBM
In Eclipse Jetty version 9.4.0.RC0 to 9.4.34.v20201102, 10.0.0.alpha0 to 10.0.0.beta2, and 11.0.0.alpha0 to 11.0.0.beta2, if GZIP request body inflation is enabled and requests from different clients are multiplexed onto a single connection, and if an attacker can send a request with a body that is received entirely but not consumed by the application, then a subsequent request on the same connection will see that body prepended to its body. The attacker will not see any data but may inject data into the body of the subsequent request.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the vulnerability ID for this Eclipse Jetty vulnerability?
The vulnerability ID for this Eclipse Jetty vulnerability is CVE-2020-27218.
What is the severity level of CVE-2020-27218?
CVE-2020-27218 has a severity level of medium (4.8).
Which versions of Eclipse Jetty are affected by this vulnerability?
Eclipse Jetty version 9.4.0.RC0 to 9.4.34.v20201102, 10.0.0.alpha0 to 10.0.0.beta2, and 11.0.0.alpha0 to 11.0.0.beta2 are affected by this vulnerability.
How can an attacker exploit CVE-2020-27218?
An attacker can exploit CVE-2020-27218 by sending a request with a body that is larger than the content length.
Are there any known remediation steps for this vulnerability?
Yes, upgrading to Eclipse Jetty version 9.4.35, 10.0.0 or 11.0.0 is recommended to remediate this vulnerability.