2020-10-19 15:01:37 +00:00
{
"data_type" : "CVE" ,
"data_format" : "MITRE" ,
"data_version" : "4.0" ,
"CVE_data_meta" : {
"ID" : "CVE-2020-27223" ,
2021-02-24 11:35:14 -05:00
"ASSIGNER" : "security@eclipse.org" ,
"STATE" : "PUBLIC"
} ,
"affects" : {
"vendor" : {
"vendor_data" : [
{
"vendor_name" : "The Eclipse Foundation" ,
"product" : {
"product_data" : [
{
"product_name" : "Eclipse Jetty" ,
"version" : {
"version_data" : [
{
"version_affected" : ">=" ,
"version_value" : "9.4.6.v20170531"
} ,
{
"version_affected" : "<=" ,
"version_value" : "9.4.36.v20210114"
} ,
{
"version_affected" : "=" ,
"version_value" : "10.0.0"
} ,
{
"version_affected" : "=" ,
"version_value" : "11.0.0"
}
]
}
}
]
}
}
]
}
2020-10-19 15:01:37 +00:00
} ,
"description" : {
"description_data" : [
{
"lang" : "eng" ,
2021-03-01 13:00:49 +00:00
"value" : "In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept headers with a large number of \u201cquality\u201d (i.e. q) parameters, the server may enter a denial of service (DoS) state due to high CPU usage processing those quality values, resulting in minutes of CPU time exhausted processing those quality values."
2021-02-24 11:35:14 -05:00
}
]
} ,
"problemtype" : {
"problemtype_data" : [
{
"description" : [
{
"lang" : "eng" ,
"value" : "CWE-407: Inefficient Algorithmic Complexity"
}
]
}
]
} ,
"references" : {
"reference_data" : [
{
"name" : "https://bugs.eclipse.org/bugs/show_bug.cgi?id=571128" ,
"refsource" : "CONFIRM" ,
"url" : "https://bugs.eclipse.org/bugs/show_bug.cgi?id=571128"
2021-02-26 16:42:20 -05:00
} ,
{
"name" : "https://github.com/eclipse/jetty.project/security/advisories/GHSA-m394-8rww-3jr7" ,
"refsource" : "CONFIRM" ,
"url" : "https://github.com/eclipse/jetty.project/security/advisories/GHSA-m394-8rww-3jr7"
2021-03-01 13:00:49 +00:00
} ,
{
"refsource" : "MLIST" ,
"name" : "[karaf-user] 20210301 Re: Jetty security defect" ,
"url" : "https://lists.apache.org/thread.html/r5612dc69e1f79c421faf9764ffbc92591e2a69ea417c04cba57f49ea@%3Cuser.karaf.apache.org%3E"
2021-03-02 10:00:41 +00:00
} ,
{
"refsource" : "MLIST" ,
"name" : "[kafka-jira] 20210302 [GitHub] [kafka] dongjinleekr commented on pull request #10245: KAFKA-12400: Upgrade jetty to fix CVE-2020-27223" ,
"url" : "https://lists.apache.org/thread.html/rd8e24a3e482e5984bc8c5492dc790413e4fdc1234e3debb94515796b@%3Cjira.kafka.apache.org%3E"
} ,
{
"refsource" : "MLIST" ,
"name" : "[kafka-dev] 20210302 [jira] [Created] (KAFKA-12400) Upgrade jetty to fix CVE-2020-27223" ,
"url" : "https://lists.apache.org/thread.html/r35ab810c0f3016b3fd3a3fa9088a2d2781b354a810780ce74d022b6c@%3Cdev.kafka.apache.org%3E"
} ,
{
"refsource" : "MLIST" ,
"name" : "[kafka-jira] 20210302 [GitHub] [kafka] dongjinleekr opened a new pull request #10245: KAFKA-12400: Upgrade jetty to fix CVE-2020-27223" ,
"url" : "https://lists.apache.org/thread.html/r2c2c7b2971360fb946bbf062c58d7245927dd1ce9150fc9987f65409@%3Cjira.kafka.apache.org%3E"
} ,
{
"refsource" : "MLIST" ,
"name" : "[kafka-jira] 20210302 [jira] [Created] (KAFKA-12400) Upgrade jetty to fix CVE-2020-27223" ,
"url" : "https://lists.apache.org/thread.html/r1b7ed296a865e3f1337a96ee9cd51f6d154d881a30da36020ca72a4b@%3Cjira.kafka.apache.org%3E"
2021-03-02 21:00:43 +00:00
} ,
{
"refsource" : "MLIST" ,
"name" : "[druid-commits] 20210302 [GitHub] [druid] a2l007 opened a new pull request #10937: Upgrade jetty to latest version" ,
"url" : "https://lists.apache.org/thread.html/rc052fd4e9e9c01bead74c0b5680355ea5dc3b72d46f253cb65d03e43@%3Ccommits.druid.apache.org%3E"
2021-03-03 00:00:45 +00:00
} ,
{
"refsource" : "MLIST" ,
"name" : "[kafka-jira] 20210302 [GitHub] [kafka] ableegoldman commented on pull request #10245: KAFKA-12400: Upgrade jetty to fix CVE-2020-27223" ,
"url" : "https://lists.apache.org/thread.html/rdd6c47321db1bfe12c68a898765bf3b6f97e2afa6a501254ed4feaed@%3Cjira.kafka.apache.org%3E"
2021-03-03 07:00:41 +00:00
} ,
{
"refsource" : "MLIST" ,
"name" : "[kafka-dev] 20210302 [jira] [Resolved] (KAFKA-12400) Upgrade jetty to fix CVE-2020-27223" ,
"url" : "https://lists.apache.org/thread.html/ra47a26c008487b0a739a368c846e168de06c3cd118d31ecedafa679a@%3Cdev.kafka.apache.org%3E"
} ,
{
"refsource" : "MLIST" ,
"name" : "[kafka-jira] 20210302 [jira] [Resolved] (KAFKA-12400) Upgrade jetty to fix CVE-2020-27223" ,
"url" : "https://lists.apache.org/thread.html/r7fbdb7880be1566f943d80fbbeefde2115c086eba1bef3115350a388@%3Cjira.kafka.apache.org%3E"
} ,
{
"refsource" : "MLIST" ,
"name" : "[kafka-commits] 20210302 [kafka] branch 2.7 updated: KAFKA-12400: Upgrade jetty to fix CVE-2020-27223" ,
"url" : "https://lists.apache.org/thread.html/rff630ce92a4d1bb494fc1a3f9b57a3d60819b436505bcd8c6ccc713c@%3Ccommits.kafka.apache.org%3E"
} ,
{
"refsource" : "MLIST" ,
"name" : "[kafka-commits] 20210302 [kafka] branch 2.8 updated: KAFKA-12400: Upgrade jetty to fix CVE-2020-27223" ,
"url" : "https://lists.apache.org/thread.html/ra384892bab8c03a60613a6a9d5e9cae0a2b800fd882792a55520115e@%3Ccommits.kafka.apache.org%3E"
} ,
{
"refsource" : "MLIST" ,
"name" : "[kafka-jira] 20210302 [GitHub] [kafka] omkreddy closed pull request #10245: KAFKA-12400: Upgrade jetty to fix CVE-2020-27223" ,
"url" : "https://lists.apache.org/thread.html/r562a0cbc5c8cac4d000a27b2854a8ab1b924aa9dd45f8ffbea98e5ad@%3Cjira.kafka.apache.org%3E"
} ,
{
"refsource" : "MLIST" ,
"name" : "[kafka-commits] 20210302 [kafka] branch 2.6 updated: KAFKA-12400: Upgrade jetty to fix CVE-2020-27223" ,
"url" : "https://lists.apache.org/thread.html/re819198d4732804dc01fca8b5b144689a118ede49f6128968773595c@%3Ccommits.kafka.apache.org%3E"
2021-03-03 10:00:44 +00:00
} ,
{
"refsource" : "MISC" ,
"name" : "https://lists.apache.org/thread.html/r3ce0e31b25ad4ee8f7c42b62cfdc72d1b586f5d6accd23f5295b6dd1@%3Cdev.kafka.apache.org%3E" ,
"url" : "https://lists.apache.org/thread.html/r3ce0e31b25ad4ee8f7c42b62cfdc72d1b586f5d6accd23f5295b6dd1@%3Cdev.kafka.apache.org%3E"
2021-03-03 12:00:40 +00:00
} ,
{
"refsource" : "MISC" ,
"name" : "https://lists.apache.org/thread.html/re0d38cc2b5da28f708fc89de49036f3ace052c47a1202f7d70291614@%3Cdev.kafka.apache.org%3E" ,
"url" : "https://lists.apache.org/thread.html/re0d38cc2b5da28f708fc89de49036f3ace052c47a1202f7d70291614@%3Cdev.kafka.apache.org%3E"
2020-10-19 15:01:37 +00:00
}
]
}
2021-03-01 13:00:49 +00:00
}
