CVE-2024-13009
Fixed in a distro release EPSS <1%CVSS 7.2
In Eclipse Jetty versions 9.4.0 to 9.4.56 a buffer can be incorrectly released when confronted with a gzip error when inflating a request body. This can result in corrupted and/or inadvertent sharing of data between requests.
Products: Eclipse Foundation Jetty
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.eclipse.jetty:jetty-server | 9.4.57.v20241219 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | cassandra-reaper | 3.8.0-r3 |
| Chainguard | celeborn-0.5 | 0.5.4-r26 |
| Chainguard | cruise-control-fips-jars | 0 |
| Chainguard | cruise-control-jars | 0 |
| Chainguard | hadoop-fips-3.4.2 | no fix |
| Chainguard | spark-fips-3.5-scala-2.13 | 3.5.8-r3 |
| Chainguard | tez | no fix |
| Debian 11 | jetty9 | 9.4.57-0+deb11u1 |
| Debian 12 | jetty9 | 9.4.57-0+deb12u1 |
| Debian 13 | jetty9 | 9.4.57-1 |
| Debian 14 | jetty9 | 9.4.57-1 |
| Red Hat satellite 6.15 | puppetserver | 0:7.17.3.1-1.el8sat |
| Red Hat satellite capsule 6.15 | puppetserver | 0:7.17.3.1-1.el8sat |
| SUSE Enterprise Storage 7.1 | jetty-minimal | 9.4.57-150200.3.31.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS | jetty-minimal | 9.4.57-150200.3.31.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | jetty-minimal | 9.4.57-150200.3.31.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | jetty-minimal | 9.4.57-150200.3.31.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS | jetty-minimal | 9.4.57-150200.3.31.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS | jetty-minimal | 9.4.57-150200.3.31.1 |
| SUSE Linux Enterprise Module for Development Tools 15 SP6 | jetty-minimal | 9.4.57-150200.3.31.1 |
| SUSE Linux Enterprise Module for Development Tools 15 SP7 | jetty-minimal | 9.4.57-150200.3.31.1 |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | jetty-minimal | 9.4.57-150200.3.31.1 |
| SUSE Linux Enterprise Module for Package Hub 15 SP7 | jetty-minimal | 9.4.57-150200.3.31.1 |
| SUSE Linux Enterprise Server 15 SP3-LTSS | jetty-minimal | 9.4.57-150200.3.31.1 |
| SUSE Linux Enterprise Server 15 SP4-LTSS | jetty-minimal | 9.4.57-150200.3.31.1 |
| SUSE Linux Enterprise Server 15 SP5-LTSS | jetty-minimal | 9.4.57-150200.3.31.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP3 | jetty-minimal | 9.4.57-150200.3.31.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | jetty-minimal | 9.4.57-150200.3.31.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP5 | jetty-minimal | 9.4.57-150200.3.31.1 |
| Ubuntu 18.04 LTS | jetty9 | no fix |
| Ubuntu 20.04 LTS | jetty9 | no fix |
| Ubuntu 22.04 LTS | jetty9 | no fix |
| Ubuntu 24.04 LTS | jetty9 | no fix |
| Wolfi | cassandra-reaper | 3.8.0-r3 |
| Wolfi | tez | no fix |
| openSUSE Leap 15.6 | jetty-minimal | 9.4.57-150200.3.31.1 |
| openSUSE Tumbleweed | jetty-minimal | 9.4.57-1.1 |