In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept headers with a large number of “quality” (i.e. q) parameters, the server may enter a denial of service (DoS) state due to high CPU usage processing those quality values, resulting in minutes of CPU time exhausted processing those quality values.

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - jetty: crafted URIs allow bypassing security constraints (CVE-2021-34429)

  - In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a     request containing multiple Accept headers with a large number of quality (i.e. q) parameters, the     server may enter a denial of service (DoS) state due to high CPU usage processing those quality values,     resulting in minutes of CPU time exhausted processing those quality values. (CVE-2020-27223)

  - In Eclipse Jetty 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to 11.0.1, if a user uses a     webapps directory that is a symlink, the contents of the webapps directory is deployed as a static webapp,     inadvertently serving the webapps themselves and anything else that might be in that directory.
    (CVE-2021-28163)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The version of Jetty installed on the remote host handles a request containing request headers with a large number of quality (i.e. q) parameters, the server may enter a denial of service (DoS) state due to high CPU usage. Note that the scanner has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-4949 advisory.

  - In Eclipse Jetty version 9.2.26 and older, 9.3.25 and older, and 9.4.15 and older, the server is     vulnerable to XSS conditions if a remote client USES a specially formatted URL against the DefaultServlet     or ResourceHandler that is configured for showing a Listing of directory contents. (CVE-2019-10241)

  - In Eclipse Jetty version 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older, the server     running on any OS and Jetty version combination will reveal the configured fully qualified directory base     resource location on the output of the 404 error for not finding a Context that matches the requested     path. The default server behavior on jetty-distribution and jetty-home will include at the end of the     Handler tree a DefaultHandler, which is responsible for reporting this 404 error, it presents the various     configured contexts as HTML for users to click through to. This produced HTML includes output that     contains the configured fully qualified directory base resource location for each context.
    (CVE-2019-10247)

  - In Eclipse Jetty versions 1.0 thru 9.4.32.v20200930, 10.0.0.alpha1 thru 10.0.0.beta2, and 11.0.0.alpha1     thru 11.0.0.beta2O, on Unix like systems, the system's temporary directory is shared between all users on     that system. A collocated user can observe the process of creating a temporary sub directory in the shared     temporary directory and race to complete the creation of the temporary subdirectory. If the attacker wins     the race then they will have read and write permission to the subdirectory used to unpack web     applications, including their WEB-INF/lib jar files and JSP files. If any code is ever executed out of     this temporary directory, this can lead to a local privilege escalation vulnerability. (CVE-2020-27216)

  - In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a     request containing multiple Accept headers with a large number of quality (i.e. q) parameters, the     server may enter a denial of service (DoS) state due to high CPU usage processing those quality values,     resulting in minutes of CPU time exhausted processing those quality values. (CVE-2020-27223)

  - The td-agent-builder plugin before 2020-12-18 for Fluentd allows attackers to gain privileges because the     bin directory is writable by a user account, but a file in bin is executed as NT AUTHORITY\SYSTEM.
    (CVE-2020-28169)

  - For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, if an exception is thrown from the     SessionListener#sessionDestroyed() method, then the session ID is not invalidated in the session ID     manager. On deployments with clustered sessions and multiple contexts this can result in a session not     being invalidated. This can result in an application used on a shared computer being left logged in.
    (CVE-2021-34428)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:2431 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing     Kubernetes application platform solution designed for on-premise or private     cloud deployments.

    This advisory contains the RPM packages for Red Hat OpenShift Container     Platform 4.5.41. See the following advisory for the container images for     this release:

    https://access.redhat.com/errata/RHSA-2021:2430

    Security Fix(es):

    * jenkins-2-plugins/config-file-provider: Does not configure its XML parser to prevent XML external entity     (XXE) attacks. (CVE-2021-21642)

    * jetty: local temporary directory hijacking vulnerability (CVE-2020-27216)

    * jetty: buffer not correctly recycled in Gzip Request inflation (CVE-2020-27218)

    * jetty: request containing multiple Accept headers with a large number of quality parameters may lead     to DoS (CVE-2020-27223)

    * jenkins-2-plugins/config-file-provider: Does not correctly perform permission checks in several HTTP     endpoints. (CVE-2021-21643)

    * jenkins-2-plugins/config-file-provider: does not require POST requests for an HTTP endpoint, resulting     in a cross-site request forgery (CSRF) vulnerability. (CVE-2021-21644)

    * jenkins-2-plugins/config-file-provider: Does not perform permission checks in several HTTP endpoints.
    (CVE-2021-21645)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * Placeholder bug for OCP 4.5.41 rpm release (BZ#1972114)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:2517 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution     designed for on-premise or private cloud deployments.

    This advisory contains the RPM packages for Red Hat OpenShift Container Platform 3.11.462. See the     following advisory for the container images for this release:

    https://access.redhat.com/errata/RHBA-2021:2516

    Space precludes documenting all of the bug fixes and enhancements in this advisory. See the following     Release Notes documentation, which will be updated shortly for this release, for details about these     changes:

    https://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html

    All OpenShift Container Platform 3.11 users are advised to upgrade to these updated packages and images.

    Security Fix(es):

    * jenkins-2-plugins/config-file-provider: Does not configure its XML parser to prevent XML external entity     (XXE) attacks. (CVE-2021-21642)

    * jetty: local temporary directory hijacking vulnerability (CVE-2020-27216)

    * jetty: buffer not correctly recycled in Gzip Request inflation (CVE-2020-27218)

    * jetty: request containing multiple Accept headers with a large number of quality parameters may lead     to DoS (CVE-2020-27223)

    * jenkins-2-plugins/config-file-provider: Does not correctly perform permission checks in several HTTP     endpoints. (CVE-2021-21643)

    * jenkins-2-plugins/config-file-provider: does not require POST requests for an HTTP endpoint, resulting     in a cross-site request forgery (CSRF) vulnerability. (CVE-2021-21644)

    * jenkins-2-plugins/config-file-provider: Does not perform permission checks in several HTTP endpoints.
    (CVE-2021-21645)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2021:2499 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing     Kubernetes application platform solution designed for on-premise or private     cloud deployments.

    This advisory contains the RPM packages for Red Hat OpenShift Container     Platform 4.6.36. See the following advisory for the container images for     this release:

    https://access.redhat.com/errata/RHBA-2021:2498

    Security Fix(es):

    * jetty: local temporary directory hijacking vulnerability (CVE-2020-27216)

    * jetty: buffer not correctly recycled in Gzip Request inflation (CVE-2020-27218)

    * jetty: request containing multiple Accept headers with a large number of quality parameters may lead     to DoS (CVE-2020-27223)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
202285	RHEL 8 : jetty (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
112998	Jetty 11.0.x < 11.0.1 Denial of Service	Web App Scanning	Component Vulnerability	medium
112997	Jetty 10.0.x < 10.0.1 Denial of Service	Web App Scanning	Component Vulnerability	medium
112996	Jetty 9.4.6 < 9.4.37 Denial of Service	Web App Scanning	Component Vulnerability	medium
152224	Debian DSA-4949-1 : jetty9 - security update	Nessus	Debian Local Security Checks	critical
151290	RHEL 7 : OpenShift Container Platform 4.5.41 (RHSA-2021:2431)	Nessus	Red Hat Local Security Checks	high
151276	RHEL 7 : OpenShift Container Platform 3.11.462 (RHSA-2021:2517)	Nessus	Red Hat Local Security Checks	high
151117	RHEL 8 : OpenShift Container Platform 4.6.36 (RHSA-2021:2499)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2020-27223

medium

Tenable Plugins

medium

medium

medium

medium

critical

high

high

high