CVE-2020-27218: eclipse jetty +16 lainnya

csirt@kutim:~/threat-intel/cve/CVE-2020-27218

CVSS 4.8 · Medium EPSS 8,3%

Kerentanan Sensitive Information in Resource Not Removed Before Reuse pada eclipse jetty, netapp oncommand system manager +15 lainnya. Skor CVSS 3.1 4.8 (Medium) menurut NVD.

Deskripsi (NVD)

In Eclipse Jetty version 9.4.0.RC0 to 9.4.34.v20201102, 10.0.0.alpha0 to 10.0.0.beta2, and 11.0.0.alpha0 to 11.0.0.beta2, if GZIP request body inflation is enabled and requests from different clients are multiplexed onto a single connection, and if an attacker can send a request with a body that is received entirely but not consumed by the application, then a subsequent request on the same connection will see that body prepended to its body. The attacker will not see any data but may inject data into the body of the subsequent request.

Rincian

Terbit di NVD: 28 November 2020
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 4.8 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-226: Sensitive Information in Resource Not Removed Before Reuse
EPSS (30 hari): 8,3% peluang dieksploitasi; lebih tinggi dari 94,8% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
eclipse	jetty	Versi 9.4.0 hingga sebelum 9.4.35
eclipse	jetty	Versi 10.0.0 alpha0
eclipse	jetty	Versi 10.0.0 alpha1
eclipse	jetty	Versi 10.0.0 beta0
eclipse	jetty	Versi 10.0.0 beta1
eclipse	jetty	Versi 10.0.0 beta2
eclipse	jetty	Versi 11.0.0 alpha0
eclipse	jetty	Versi 11.0.0 beta1
eclipse	jetty	Versi 11.0.0 beta2
netapp	oncommand system manager	Versi 3.0 hingga 3.1.3
netapp	snap creator framework	Semua versi
oracle	blockchain platform	Semua versi sebelum 21.1.2
oracle	communications converged application server - service controller	Versi 6.2
oracle	communications offline mediation controller	Versi 12.0.0.3.0
oracle	communications pricing design center	Versi 12.0.0.3.0
oracle	communications services gatekeeper	Versi 7.0
oracle	communications session route manager	Versi 8.0.0 hingga 8.2.4
oracle	flexcube private banking	Versi 12.0.0
oracle	flexcube private banking	Versi 12.1.0
oracle	hyperion infrastructure technology	Versi 11.1.2.6.0
oracle	rest data services	Semua versi sebelum 20.4.3.050.1904
oracle	retail eftlink	Versi 20.0.0
oracle	siebel core - automation	Semua versi hingga 21.5
apache	kafka	Versi 2.7.0
apache	spark	Versi 2.4.8
apache	spark	Versi 3.0.3
debian	debian linux	Versi 10.0

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://bugs.eclipse.org/bugs/show_bug.cgi?id=568892 issue tracking · advisory vendor
https://www.oracle.com//security-alerts/cpujul2021.html patch · advisory pihak ketiga
https://www.oracle.com/security-alerts/cpuApr2021.html patch · advisory pihak ketiga
https://www.oracle.com/security-alerts/cpuapr2022.html patch · advisory pihak ketiga
https://www.oracle.com/security-alerts/cpuoct2021.html patch · advisory pihak ketiga
https://github.com/eclipse/jetty.project/security/advisories/GHSA-86wm-rrjm-8wh8 advisory pihak ketiga
https://lists.debian.org/debian-lts-announce/2023/10/msg00045.html mailing list · advisory pihak ketiga
https://security.netapp.com/advisory/ntap-20201218-0003/ advisory pihak ketiga
https://lists.apache.org/thread.html/r00858fe27ee35ac8fa0e1549d67e0efb789d63b791b5300390bd8480%40%3Cjira.kafka... issue tracking
https://lists.apache.org/thread.html/r01806ad8c9cb0590584baf5b1a60237ad92e4ad5bba082ca04d98179%40%3Creviews.sp... issue tracking
https://lists.apache.org/thread.html/r05b7ffde2b8c180709e14bc9ca036407bea3ed9f09b32c4705d23a4a%40%3Cjira.kafka... issue tracking
https://lists.apache.org/thread.html/r078c1203e48089b2c934b9f86b61bebe8c049e0ea6273b124f349988%40%3Cissues.hba... issue tracking
https://lists.apache.org/thread.html/r0d2de2ab5558da68b504bd30db74da1d97dc152a857f5b7e462288ab%40%3Cissues.spa... issue tracking
https://lists.apache.org/thread.html/r153fbefc27a1b2033692f32ef728ca909a7c7bcc1d21b6c35b38bdd5%40%3Creviews.sp... issue tracking
https://lists.apache.org/thread.html/r15500b77c52390e2ec048cea4a6b45edf907ea61cd13259193ff8601%40%3Creviews.sp... issue tracking
https://lists.apache.org/thread.html/r186748e676e5aeb4eb603361e6367555ae4daecbde55cfd69fa68ec6%40%3Cissues.hba... issue tracking
https://lists.apache.org/thread.html/r1dd302323c6fe1a542d0371de66a484918fa6c2831ae70d924974bea%40%3Cnotificati... issue tracking
https://lists.apache.org/thread.html/r22776d06582985cca5bd2a92519a2b13b4cae2d8e087318da03c036d%40%3Cnotificati... issue tracking
https://lists.apache.org/thread.html/r23ce6b8965e30808daa77a80fcd69833b1fc632d80465d0419eff619%40%3Cissues.zoo... issue tracking
https://lists.apache.org/thread.html/r25a47cd06750ebb4b0f23a9b7a57c209702c8566a4c970a41ac088df%40%3Creviews.sp... issue tracking
https://lists.apache.org/thread.html/r2a541f08bf5f847394297c13a5305c2f76c11e46504ce2a49653890a%40%3Creviews.sp... issue tracking
https://lists.apache.org/thread.html/r2a57c7bbf36afc87f8ad9e1dd2f53a08e85a1b531283fc2efce4fe17%40%3Ccommits.zo... issue tracking
https://lists.apache.org/thread.html/r2f168fd22c071bdd95ec696e45d2a01e928b9fcadbe94fbabeb1549d%40%3Cissues.hba... issue tracking
https://lists.apache.org/thread.html/r2fda4dab73097051977f2ab818f75e04fbcb15bb1003c8530eac1059%40%3Cjira.kafka... issue tracking
https://lists.apache.org/thread.html/r2ffe719224cbe5897f2d06dd22fc77fa12377c39efe9de0c3bf3f837%40%3Cissues.hba... issue tracking

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.