CVE-2020-27218

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2020-27218
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-27218.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2020-27218
Aliases
Downstream
Related
Published
2020-11-28T01:15:11.587Z
Modified
2026-07-08T05:59:29.333972008Z
Severity
  • 4.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L CVSS Calculator
Summary
[none]
Details

In Eclipse Jetty version 9.4.0.RC0 to 9.4.34.v20201102, 10.0.0.alpha0 to 10.0.0.beta2, and 11.0.0.alpha0 to 11.0.0.beta2, if GZIP request body inflation is enabled and requests from different clients are multiplexed onto a single connection, and if an attacker can send a request with a body that is received entirely but not consumed by the application, then a subsequent request on the same connection will see that body prepended to its body. The attacker will not see any data but may inject data into the body of the subsequent request.

Database specific 
{
    "unresolved_ranges": [
        {
            "cpes": [
                "cpe:2.3:a:netapp:oncommand_system_manager:*:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "introduced": "3.0"
                },
                {
                    "last_affected": "3.1.3"
                }
            ],
            "vendor_product": "netapp:oncommand_system_manager",
            "source": "CPE_RANGE"
        },
        {
            "cpes": [
                "cpe:2.3:a:oracle:blockchain_platform:*:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "fixed": "21.1.2"
                }
            ],
            "vendor_product": "oracle:blockchain_platform",
            "source": "CPE_RANGE"
        },
        {
            "cpes": [
                "cpe:2.3:a:oracle:communications_session_route_manager:*:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "introduced": "8.0.0"
                },
                {
                    "last_affected": "8.2.4"
                }
            ],
            "vendor_product": "oracle:communications_session_route_manager",
            "source": "CPE_RANGE"
        },
        {
            "cpes": [
                "cpe:2.3:a:oracle:rest_data_services:*:*:*:*:-:*:*:*"
            ],
            "extracted_events": [
                {
                    "fixed": "20.4.3.050.1904"
                }
            ],
            "vendor_product": "oracle:rest_data_services",
            "source": "CPE_RANGE"
        },
        {
            "cpes": [
                "cpe:2.3:a:oracle:siebel_core_-_automation:*:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "last_affected": "21.5"
                }
            ],
            "vendor_product": "oracle:siebel_core_-_automation",
            "source": "CPE_RANGE"
        },
        {
            "cpes": [
                "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "introduced": "10.0"
                },
                {
                    "last_affected": "10.0"
                }
            ],
            "vendor_product": "debian:debian_linux",
            "source": "CPE_STRING"
        },
        {
            "cpes": [
                "cpe:2.3:a:eclipse:jetty:10.0.0:alpha0:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "introduced": "10.0.0-alpha0"
                },
                {
                    "last_affected": "10.0.0-alpha0"
                },
                {
                    "introduced": "10.0.0-alpha0"
                },
                {
                    "last_affected": "10.0.0-alpha0"
                }
            ],
            "vendor_product": "eclipse:jetty",
            "source": "CPE_STRING"
        },
        {
            "cpes": [
                "cpe:2.3:a:oracle:communications_converged_application_server_-_service_controller:6.2:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "introduced": "6.2"
                },
                {
                    "last_affected": "6.2"
                }
            ],
            "vendor_product": "oracle:communications_converged_application_server_-_service_controller",
            "source": "CPE_STRING"
        },
        {
            "cpes": [
                "cpe:2.3:a:oracle:communications_offline_mediation_controller:12.0.0.3.0:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "introduced": "12.0.0.3.0"
                },
                {
                    "last_affected": "12.0.0.3.0"
                }
            ],
            "vendor_product": "oracle:communications_offline_mediation_controller",
            "source": "CPE_STRING"
        },
        {
            "cpes": [
                "cpe:2.3:a:oracle:communications_pricing_design_center:12.0.0.3.0:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "introduced": "12.0.0.3.0"
                },
                {
                    "last_affected": "12.0.0.3.0"
                }
            ],
            "vendor_product": "oracle:communications_pricing_design_center",
            "source": "CPE_STRING"
        },
        {
            "cpes": [
                "cpe:2.3:a:oracle:communications_services_gatekeeper:7.0:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "introduced": "7.0"
                },
                {
                    "last_affected": "7.0"
                }
            ],
            "vendor_product": "oracle:communications_services_gatekeeper",
            "source": "CPE_STRING"
        },
        {
            "cpes": [
                "cpe:2.3:a:oracle:flexcube_private_banking:12.0.0:*:*:*:*:*:*:*",
                "cpe:2.3:a:oracle:flexcube_private_banking:12.1.0:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "introduced": "12.0.0"
                },
                {
                    "last_affected": "12.0.0"
                },
                {
                    "introduced": "12.1.0"
                },
                {
                    "last_affected": "12.1.0"
                }
            ],
            "vendor_product": "oracle:flexcube_private_banking",
            "source": "CPE_STRING"
        },
        {
            "cpes": [
                "cpe:2.3:a:oracle:hyperion_infrastructure_technology:11.1.2.6.0:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "introduced": "11.1.2.6.0"
                },
                {
                    "last_affected": "11.1.2.6.0"
                }
            ],
            "vendor_product": "oracle:hyperion_infrastructure_technology",
            "source": "CPE_STRING"
        },
        {
            "cpes": [
                "cpe:2.3:a:oracle:retail_eftlink:20.0.0:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "introduced": "20.0.0"
                },
                {
                    "last_affected": "20.0.0"
                }
            ],
            "vendor_product": "oracle:retail_eftlink",
            "source": "CPE_STRING"
        }
    ]
}
References

Affected packages

Git / github.com/apache/kafka

Affected ranges

Type
GIT
Repo
https://github.com/apache/kafka
Events
Introduced
448719dc99a19793d55aaaa8b64282ed3fb3197d
Last affected
448719dc99a19793d55aaaa8b64282ed3fb3197d
Database specific 
{
    "cpe": "cpe:2.3:a:apache:kafka:2.7.0:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "2.7.0"
        },
        {
            "last_affected": "2.7.0"
        }
    ],
    "source": "CPE_STRING"
}

Affected versions

2.*
2.7.0
2.7.0-rc6

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-27218.json"

Git / github.com/apache/spark

Affected ranges

Type
GIT
Repo
https://github.com/apache/spark
Events
Introduced
163fbd2528a18bf062bddf7b7753631a12a369b5
Last affected
65ac1e75dc468f53fc778cd2ce1ba3f21067aab8
Database specific 
{
    "cpe": [
        "cpe:2.3:a:apache:spark:2.4.8:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:spark:3.0.3:*:*:*:*:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "2.4.8"
        },
        {
            "last_affected": "2.4.8"
        },
        {
            "introduced": "3.0.3"
        },
        {
            "last_affected": "3.0.3"
        }
    ],
    "source": "CPE_STRING"
}

Affected versions

2.*
2.4.8
3.*
3.0.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-27218.json"

Git / github.com/jetty/jetty.project

Affected ranges

Type
GIT
Repo
https://github.com/jetty/jetty.project
Events
Introduced
bf9d17540c7ae4c91be30c045a9485aa2030d3e5
Fixed
bdc54f03a5e0a7e280fab27f55c3c75ee8da89fb
Introduced
8cbfd51e80586a614cbc291078584d9f4aab3deb
Last affected
9ce21ec22be920f61d3c840718d661c0f9d1e174
Database specific 
{
    "cpe": [
        "cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:jetty:10.0.0:alpha0:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:jetty:10.0.0:alpha1:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:jetty:10.0.0:beta0:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:jetty:10.0.0:beta1:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:jetty:10.0.0:beta2:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:jetty:11.0.0:alpha0:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:jetty:11.0.0:beta1:*:*:*:*:*:*",
        "cpe:2.3:a:eclipse:jetty:11.0.0:beta2:*:*:*:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "9.4.0"
        },
        {
            "fixed": "9.4.35"
        },
        {
            "introduced": "10.0.0-alpha0"
        },
        {
            "last_affected": "10.0.0-alpha0"
        },
        {
            "introduced": "10.0.0-alpha1"
        },
        {
            "last_affected": "10.0.0-alpha1"
        },
        {
            "introduced": "10.0.0-beta0"
        },
        {
            "last_affected": "10.0.0-beta0"
        },
        {
            "introduced": "10.0.0-beta1"
        },
        {
            "last_affected": "10.0.0-beta1"
        },
        {
            "introduced": "10.0.0-beta2"
        },
        {
            "last_affected": "10.0.0-beta2"
        },
        {
            "introduced": "11.0.0-alpha0"
        },
        {
            "last_affected": "11.0.0-alpha0"
        },
        {
            "introduced": "11.0.0-beta1"
        },
        {
            "last_affected": "11.0.0-beta1"
        },
        {
            "introduced": "11.0.0-beta2"
        },
        {
            "last_affected": "11.0.0-beta2"
        }
    ],
    "source": [
        "CPE_RANGE",
        "CPE_STRING"
    ]
}

Affected versions

10.*
10.0.0-alpha0
10.0.0-alpha1
10.0.0-beta0
10.0.0-beta1
10.0.0-beta2
11.*
11.0.0-alpha0
11.0.0-beta1
11.0.0-beta2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-27218.json"