CVE-2020-27223
Fixed in a distro release EPSS 78%CVSS 5.2
In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept headers with a large number of “quality” (i.e. q) parameters, the server may enter a denial of service (DoS) state due to high CPU usage processing those quality values, resulting in minutes of CPU time exhausted processing those quality values.
Products: The Eclipse Foundation Eclipse Jetty
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.eclipse.jetty:jetty-server | 9.4.37 |
| Maven | org.eclipse.jetty:jetty-server | 10.0.1 |
| Maven | org.eclipse.jetty:jetty-server | 11.0.1 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian:10 | jetty9 | 9.4.16-0+deb10u1 |
| Debian:12 | jetty9 | 9.4.38-1 |
| Debian:13 | jetty9 | 9.4.38-1 |
| Debian:14 | jetty9 | 9.4.38-1 |
| Red Hat:openshift:3.11 | jenkins | 0:2.289.1.1624365627-1.el7 |
| Red Hat:openshift:3.11 | jenkins-2-plugins | 0:3.11.1624366838-1.el7 |
| Red Hat:openshift:4.5 | jenkins | 0:2.277.3.1623846768-1.el7 |
| Red Hat:openshift:4.5 | jenkins-2-plugins | 0:4.5.1623326336-1.el7 |
| Red Hat:openshift:4.6 | jenkins | 0:2.277.3.1623853726-1.el8 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP2 | jetty-minimal | 9.4.38-3.6.2 |
| Ubuntu:16.04:LTS | jetty9 | no fix |
| Ubuntu:18.04:LTS | jetty9 | no fix |
| Ubuntu:20.04:LTS | jetty9 | no fix |
| Ubuntu:22.04:LTS | jetty9 | no fix |