HTTP Request Smuggling Affecting org.eclipse.jetty:jetty-server package, versions [9.4.0.RC0, 9.4.35.v20201120) [10.0.0.alpha0, 10.0.0.beta3) [11.0.0.alpha0, 11.0.0.beta3)
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JAVA-ORGECLIPSEJETTY-1047304
- published 29 Nov 2020
- disclosed 29 Nov 2020
- credit easbar, karussell
Introduced: 29 Nov 2020
CVE-2020-27218 Open this link in a new tabHow to fix?
Upgrade org.eclipse.jetty:jetty-server to version 9.4.35.v20201120, 10.0.0.beta3, 11.0.0.beta3 or higher.
Overview
org.eclipse.jetty:jetty-server is a lightweight highly scalable java based web server and servlet engine.
Affected versions of this package are vulnerable to HTTP Request Smuggling. If GZIP request body inflation is enabled and requests from different clients are multiplexed onto a single connection, and if an attacker can send a request with a body that is received entirely but not consumed by the application, then a subsequent request on the same connection will see that body prepended to its body. The attacker will not see any data but may inject data into the body of the subsequent request.