5.8 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:N/I:P/A:P
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
8.8 High
AI Score
Confidence
High
0.732 High
EPSS
Percentile
98.1%
Package : jetty9
Version : 9.4.50-4+deb10u1
CVE ID : CVE-2020-27218 CVE-2023-36478 CVE-2023-44487
Debian Bug : 976211
Two remotely exploitable security vulnerabilities were discovered in Jetty 9,
a Java based web server and servlet engine.
The HTTP/2 protocol implementation did not sufficiently verify if HPACK header
values exceed their size limit. Furthermore the HTTP/2 protocol allowed a
denial of service (server resource consumption) because request cancellation
can reset many streams quickly. This problem is also known as Rapid Reset
Attack.
In addition this version also addresses CVE-2020-27218.
If GZIP request body inflation is enabled and requests from different clients
are multiplexed onto a single connection, and if an attacker can send a request
with a body that is received entirely but not consumed by the application, then
a subsequent request on the same connection will see that body prepended to its
body. The attacker will not see any data but may inject data into the body of
the subsequent request.
For Debian 10 buster, these problems have been fixed in version
9.4.50-4+deb10u1.
We recommend that you upgrade your jetty9 packages.
For the detailed security status of jetty9 please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/jetty9
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
Attachment:
signature.asc
Description: This is a digitally signed message part
5.8 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:N/I:P/A:P
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
8.8 High
AI Score
Confidence
High
0.732 High
EPSS
Percentile
98.1%