CVE-2020-27218

MITRE NVD CVE.ORG Print: PDF PDF

Summary

CVECVE-2020-27218
StatePUBLIC
Assigner[email protected]
Source PriorityCVE Program / NVD first with legacy fallback
Published2020-11-28 01:15:00 UTC
Updated2023-11-07 03:20:00 UTC
DescriptionIn Eclipse Jetty version 9.4.0.RC0 to 9.4.34.v20201102, 10.0.0.alpha0 to 10.0.0.beta2, and 11.0.0.alpha0 to 11.0.0.beta2, if GZIP request body inflation is enabled and requests from different clients are multiplexed onto a single connection, and if an attacker can send a request with a body that is received entirely but not consumed by the application, then a subsequent request on the same connection will see that body prepended to its body. The attacker will not see any data but may inject data into the body of the subsequent request.

Risk And Classification

Problem Types: NVD-CWE-noinfo

NVD Known Affected Configurations (CPE 2.3)

TypeVendorProductVersionUpdateEditionLanguage
Application Apache Kafka 2.7.0 All All All
Application Apache Spark 2.4.8 All All All
Application Apache Spark 3.0.3 All All All
Application Eclipse Jetty All All All All
Application Eclipse Jetty 10.0.0 alpha0 All All
Application Eclipse Jetty 10.0.0 alpha1 All All
Application Eclipse Jetty 10.0.0 beta0 All All
Application Eclipse Jetty 10.0.0 beta1 All All
Application Eclipse Jetty 10.0.0 beta2 All All
Application Eclipse Jetty 11.0.0 alpha0 All All
Application Eclipse Jetty 11.0.0 beta1 All All
Application Eclipse Jetty 11.0.0 beta2 All All
Application Eclipse Jetty All All All All
Application Eclipse Jetty 10.0.0 alpha0 All All
Application Eclipse Jetty 10.0.0 alpha1 All All
Application Eclipse Jetty 10.0.0 beta0 All All
Application Eclipse Jetty 10.0.0 beta1 All All
Application Eclipse Jetty 10.0.0 beta2 All All
Application Eclipse Jetty 11.0.0 alpha0 All All
Application Eclipse Jetty 11.0.0 beta1 All All
Application Eclipse Jetty 11.0.0 beta2 All All
Application Netapp Oncommand System Manager All All All All
Application Netapp Snap Creator Framework - All All All
Application Netapp Snap Creator Framework - All All All
Application Oracle Blockchain Platform All All All All
Application Oracle Communications Converged Application Server - Service Controller 6.2 All All All
Application Oracle Communications Offline Mediation Controller 12.0.0.3.0 All All All
Application Oracle Communications Pricing Design Center 12.0.0.3.0 All All All
Application Oracle Communications Services Gatekeeper 7.0 All All All
Application Oracle Communications Session Route Manager All All All All
Application Oracle Flexcube Private Banking 12.0.0 All All All
Application Oracle Flexcube Private Banking 12.1.0 All All All
Application Oracle Hyperion Infrastructure Technology 11.1.2.6.0 All All All
Application Oracle Rest Data Services All All All All
Application Oracle Retail Eftlink 20.0.0 All All All
Application Oracle Siebel Core - Automation All All All All

References

ReferenceSourceLinkTags
Pony Mail! lists.apache.org
Pony Mail! MLIST lists.apache.org Mailing List, Third Party Advisory
Pony Mail! lists.apache.org
Pony Mail! lists.apache.org
Pony Mail! lists.apache.org
Pony Mail! MLIST lists.apache.org Mailing List, Patch, Third Party Advisory
Pony Mail! lists.apache.org
Pony Mail! MLIST lists.apache.org Mailing List, Third Party Advisory
Pony Mail! MLIST lists.apache.org Exploit, Mailing List, Third Party Advisory
Pony Mail! lists.apache.org
Pony Mail! MLIST lists.apache.org Mailing List, Third Party Advisory
Pony Mail! MLIST lists.apache.org Mailing List, Third Party Advisory
Pony Mail! lists.apache.org
Pony Mail! lists.apache.org
Pony Mail! lists.apache.org
Pony Mail! MLIST lists.apache.org Mailing List, Third Party Advisory
Pony Mail! lists.apache.org
Pony Mail! MLIST lists.apache.org Mailing List
Pony Mail! MLIST lists.apache.org Mailing List, Third Party Advisory
Pony Mail! lists.apache.org
[kafka-jira] 20210301 [GitHub] [kafka] dongjinleekr commented on pull request #10235: KAFKA-12389: Upgrade of netty-codec due to CVE-2021-21290 lists.apache.org
Pony Mail! lists.apache.org
Pony Mail! lists.apache.org
Pony Mail! MLIST lists.apache.org Mailing List, Third Party Advisory
Pony Mail! MLIST lists.apache.org Exploit, Mailing List, Third Party Advisory
Pony Mail! lists.apache.org
Pony Mail! MLIST lists.apache.org Mailing List
Pony Mail! MLIST lists.apache.org Mailing List, Third Party Advisory
Pony Mail! lists.apache.org
Pony Mail! MLIST lists.apache.org Mailing List
Pony Mail! MLIST lists.apache.org Mailing List, Third Party Advisory
Pony Mail! MLIST lists.apache.org Mailing List, Third Party Advisory
Pony Mail! lists.apache.org
Pony Mail! lists.apache.org
Pony Mail! MLIST lists.apache.org Mailing List, Third Party Advisory
Pony Mail! MLIST lists.apache.org Mailing List, Third Party Advisory
Pony Mail! lists.apache.org
Pony Mail! MLIST lists.apache.org Mailing List, Third Party Advisory
Pony Mail! lists.apache.org
Pony Mail! lists.apache.org
Pony Mail! MLIST lists.apache.org Mailing List, Third Party Advisory
Pony Mail! MLIST lists.apache.org Mailing List, Third Party Advisory
Pony Mail! lists.apache.org
Pony Mail! MLIST lists.apache.org Mailing List, Third Party Advisory
568892 – (CVE-2020-27218) Jetty HttpInput not correctly recycled CONFIRM bugs.eclipse.org Issue Tracking, Vendor Advisory
Pony Mail! lists.apache.org
Pony Mail! MLIST lists.apache.org Mailing List, Third Party Advisory
Pony Mail! lists.apache.org
Pony Mail! MLIST lists.apache.org Mailing List, Third Party Advisory
Pony Mail! lists.apache.org
Pony Mail! lists.apache.org
Oracle Critical Patch Update Advisory - April 2022 MISC www.oracle.com
Pony Mail! MLIST lists.apache.org Mailing List, Third Party Advisory
Pony Mail! MLIST lists.apache.org Mailing List, Third Party Advisory
Pony Mail! MLIST lists.apache.org Mailing List, Third Party Advisory
[SECURITY] [DLA 3641-1] jetty9 security update MLIST lists.debian.org
Pony Mail! lists.apache.org
Pony Mail! MLIST lists.apache.org Mailing List, Third Party Advisory
Pony Mail! lists.apache.org
Pony Mail! MLIST lists.apache.org Mailing List, Third Party Advisory
Pony Mail! MLIST lists.apache.org Mailing List, Third Party Advisory
Pony Mail! lists.apache.org
Pony Mail! lists.apache.org
Pony Mail! MLIST lists.apache.org Mailing List, Patch, Third Party Advisory
Pony Mail! MLIST lists.apache.org Mailing List, Third Party Advisory
Pony Mail! MLIST lists.apache.org Mailing List, Third Party Advisory
Pony Mail! MLIST lists.apache.org Mailing List, Third Party Advisory
Pony Mail! lists.apache.org
Pony Mail! lists.apache.org
Pony Mail! lists.apache.org
Pony Mail! lists.apache.org
Pony Mail! lists.apache.org
Pony Mail! MLIST lists.apache.org Mailing List
Pony Mail! lists.apache.org
Pony Mail! MLIST lists.apache.org Mailing List, Third Party Advisory
Pony Mail! MLIST lists.apache.org Mailing List
Pony Mail! lists.apache.org
Pony Mail! MLIST lists.apache.org
Pony Mail! MLIST lists.apache.org Mailing List, Third Party Advisory
Pony Mail! lists.apache.org
Pony Mail! MLIST lists.apache.org Mailing List, Third Party Advisory
Pony Mail! lists.apache.org
CVE-2020-27218 Eclipse Jetty Vulnerability in NetApp Products | NetApp Product Security CONFIRM security.netapp.com Third Party Advisory
Pony Mail! lists.apache.org
Oracle Critical Patch Update Advisory - July 2021 N/A www.oracle.com
Pony Mail! MLIST lists.apache.org Mailing List, Third Party Advisory
Pony Mail! MLIST lists.apache.org Mailing List, Third Party Advisory
Pony Mail! lists.apache.org
Pony Mail! MLIST lists.apache.org Mailing List
Pony Mail! lists.apache.org
Pony Mail! MLIST lists.apache.org Mailing List, Third Party Advisory
Pony Mail! MLIST lists.apache.org Mailing List, Third Party Advisory
Pony Mail! lists.apache.org
Pony Mail! lists.apache.org
Pony Mail! lists.apache.org
Pony Mail! MLIST lists.apache.org Mailing List, Third Party Advisory
Pony Mail! MLIST lists.apache.org Mailing List
Oracle Critical Patch Update Advisory - October 2021 MISC www.oracle.com
Pony Mail! MLIST lists.apache.org Mailing List
Pony Mail! lists.apache.org
Pony Mail! lists.apache.org
Pony Mail! lists.apache.org
Pony Mail! MLIST lists.apache.org Mailing List, Third Party Advisory
Pony Mail! MLIST lists.apache.org Mailing List, Third Party Advisory
Pony Mail! lists.apache.org
Pony Mail! lists.apache.org
Pony Mail! lists.apache.org
Pony Mail! MLIST lists.apache.org Mailing List, Third Party Advisory
Pony Mail! MLIST lists.apache.org Mailing List, Third Party Advisory
Pony Mail! MLIST lists.apache.org Mailing List
Pony Mail! MLIST lists.apache.org Mailing List, Third Party Advisory
Pony Mail! lists.apache.org
Pony Mail! lists.apache.org
Pony Mail! lists.apache.org
Pony Mail! MLIST lists.apache.org Mailing List, Third Party Advisory
Pony Mail! MISC lists.apache.org Mailing List
Pony Mail! MLIST lists.apache.org Mailing List
Pony Mail! MLIST lists.apache.org Mailing List, Third Party Advisory
Pony Mail! MLIST lists.apache.org Mailing List, Third Party Advisory
Pony Mail! lists.apache.org
Pony Mail! MLIST lists.apache.org Mailing List
Pony Mail! MISC lists.apache.org Mailing List
Pony Mail! lists.apache.org
Pony Mail! lists.apache.org
Pony Mail! lists.apache.org
Pony Mail! MLIST lists.apache.org Mailing List
Pony Mail! MLIST lists.apache.org Mailing List
Pony Mail! lists.apache.org
Pony Mail! MLIST lists.apache.org Mailing List, Third Party Advisory
Pony Mail! MLIST lists.apache.org Mailing List, Third Party Advisory
Pony Mail! MLIST lists.apache.org Mailing List, Third Party Advisory
Pony Mail! lists.apache.org
Pony Mail! lists.apache.org
Pony Mail! lists.apache.org
Pony Mail! lists.apache.org
Pony Mail! MLIST lists.apache.org Mailing List, Third Party Advisory
Pony Mail! lists.apache.org
Pony Mail! lists.apache.org
Pony Mail! MLIST lists.apache.org Mailing List
Pony Mail! lists.apache.org
Pony Mail! MLIST lists.apache.org Mailing List, Patch, Third Party Advisory
Pony Mail! lists.apache.org
Pony Mail! lists.apache.org
Pony Mail! MLIST lists.apache.org Mailing List, Third Party Advisory
Pony Mail! lists.apache.org
Pony Mail! MLIST lists.apache.org Mailing List, Third Party Advisory
Pony Mail! MLIST lists.apache.org Mailing List, Third Party Advisory
Pony Mail! lists.apache.org
Pony Mail! lists.apache.org
Pony Mail! MLIST lists.apache.org Mailing List
Pony Mail! lists.apache.org
Pony Mail! lists.apache.org
Pony Mail! MLIST lists.apache.org Mailing List, Third Party Advisory
Pony Mail! MLIST lists.apache.org Mailing List, Third Party Advisory
Pony Mail! MLIST lists.apache.org Mailing List, Third Party Advisory
Pony Mail! lists.apache.org
Pony Mail! MLIST lists.apache.org Mailing List, Third Party Advisory
Pony Mail! MLIST lists.apache.org Mailing List, Third Party Advisory
Pony Mail! lists.apache.org
Pony Mail! lists.apache.org
Pony Mail! MLIST lists.apache.org Mailing List
Pony Mail! lists.apache.org
Pony Mail! lists.apache.org
Pony Mail! MLIST lists.apache.org Mailing List, Third Party Advisory
Pony Mail! MISC lists.apache.org Mailing List
Pony Mail! MLIST lists.apache.org Mailing List
Pony Mail! MLIST lists.apache.org Mailing List, Third Party Advisory
Pony Mail! lists.apache.org
Pony Mail! lists.apache.org
Pony Mail! MLIST lists.apache.org Exploit, Mailing List, Third Party Advisory
Buffer not correctly recycled in Gzip Request inflation · Advisory · eclipse/jetty.project · GitHub CONFIRM github.com Third Party Advisory
Pony Mail! MLIST lists.apache.org Mailing List, Third Party Advisory
Pony Mail! lists.apache.org
Pony Mail! lists.apache.org
Pony Mail! MLIST lists.apache.org Mailing List
Pony Mail! MLIST lists.apache.org Mailing List, Patch, Third Party Advisory
Pony Mail! lists.apache.org
Pony Mail! MLIST lists.apache.org Mailing List, Third Party Advisory
Pony Mail! lists.apache.org
Pony Mail! MLIST lists.apache.org Mailing List, Third Party Advisory
Pony Mail! lists.apache.org
Pony Mail! lists.apache.org
[nifi-commits] 20210222 svn commit: r1886814 - /nifi/site/trunk/security.html lists.apache.org
Pony Mail! MLIST lists.apache.org Mailing List, Third Party Advisory
Pony Mail! MISC lists.apache.org Mailing List
Pony Mail! lists.apache.org
Pony Mail! MLIST lists.apache.org Mailing List, Third Party Advisory
Pony Mail! MLIST lists.apache.org Mailing List, Patch, Third Party Advisory
Pony Mail! MLIST lists.apache.org Mailing List, Third Party Advisory
Pony Mail! MLIST lists.apache.org Mailing List
Pony Mail! MLIST lists.apache.org Mailing List, Third Party Advisory
Pony Mail! lists.apache.org
Pony Mail! lists.apache.org
Pony Mail! MLIST lists.apache.org Mailing List, Third Party Advisory
Pony Mail! lists.apache.org
Pony Mail! lists.apache.org
Pony Mail! lists.apache.org
Pony Mail! MLIST lists.apache.org Mailing List
Pony Mail! lists.apache.org
Pony Mail! MLIST lists.apache.org Mailing List, Third Party Advisory
Pony Mail! lists.apache.org
Pony Mail! MLIST lists.apache.org Mailing List, Third Party Advisory
Pony Mail! lists.apache.org
Pony Mail! lists.apache.org
Pony Mail! lists.apache.org
Pony Mail! lists.apache.org
Pony Mail! MLIST lists.apache.org Mailing List, Third Party Advisory
Pony Mail! MLIST lists.apache.org Mailing List, Third Party Advisory
Pony Mail! lists.apache.org
Pony Mail! MLIST lists.apache.org Mailing List, Third Party Advisory
Pony Mail! lists.apache.org
Pony Mail! lists.apache.org
Pony Mail! MLIST lists.apache.org Mailing List, Third Party Advisory
Pony Mail! MLIST lists.apache.org Mailing List, Third Party Advisory
Pony Mail! lists.apache.org
Pony Mail! lists.apache.org
Pony Mail! MLIST lists.apache.org Mailing List
Pony Mail! lists.apache.org
Pony Mail! MLIST lists.apache.org Mailing List
Pony Mail! lists.apache.org
Pony Mail! lists.apache.org
Oracle Critical Patch Update Advisory - April 2021 MISC www.oracle.com
Pony Mail! lists.apache.org
Pony Mail! MLIST lists.apache.org Mailing List, Third Party Advisory
Pony Mail! MLIST lists.apache.org Mailing List, Third Party Advisory
Pony Mail! lists.apache.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

Legacy QID Mappings

  • 239471 Red Hat Update for OpenShift Container Platform 3.11 (RHSA-2021:2517)
  • 239472 Red Hat Update for OpenShift Container Platform 4.6.36 (RHSA-2021:2499)
  • 239473 Red Hat Update for OpenShift Container Platform 4.5.41 (RHSA-2021:2431)
  • 6000267 Debian Security Update for jetty9 (DLA 3641-1)
  • 750448 OpenSUSE Security Update for jetty-minimal (openSUSE-SU-2021:0012-1)
  • 770073 Red Hat OpenShift Container Platform 4.6 Security Update (RHSA-2021:2499)
  • 770075 Red Hat OpenShift Container Platform 4.5 Security Update (RHSA-2021:2431)
  • 770115 Red Hat OpenShift Container Platform 4.5 Security Update (RHSA-2021-2431)
  • 770123 Red Hat OpenShift Container Platform 4.6 Security Update (RHSA-2021-2499)
  • 982094 Java (maven) Security Update for org.eclipse.jetty:jetty-server (GHSA-86wm-rrjm-8wh8)
© CVE.report 2026 |

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

CVE.report and Source URL Uptime Status status.cve.report