The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3641 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3641-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                      Markus Koschany     October 30, 2023                              https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : jetty9     Version        : 9.4.50-4+deb10u1     CVE ID         : CVE-2020-27218 CVE-2023-36478 CVE-2023-44487     Debian Bug     : 976211

    Two remotely exploitable security vulnerabilities were discovered in Jetty 9,     a Java based web server and servlet engine.

    The HTTP/2 protocol implementation did not sufficiently verify if HPACK header     values exceed their size limit. Furthermore the HTTP/2 protocol allowed a     denial of service (server resource consumption) because request cancellation     can reset many streams quickly. This problem is also known as Rapid Reset     Attack.

    In addition this version also addresses CVE-2020-27218.

    If GZIP request body inflation is enabled and requests from different clients     are multiplexed onto a single connection, and if an attacker can send a request     with a body that is received entirely but not consumed by the application, then     a subsequent request on the same connection will see that body prepended to its     body. The attacker will not see any data but may inject data into the body of     the subsequent request.

    For Debian 10 buster, these problems have been fixed in version     9.4.50-4+deb10u1.

    We recommend that you upgrade your jetty9 packages.

    For the detailed security status of jetty9 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/jetty9

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: This is a digitally signed message part

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Debian dla-3641 : jetty9 - security update

critical Nessus Plugin ID 184061

Version 1.3

Version 1.2

Version 1.1

Version 1.0

Version 1.3 Jan 22, 2025, 8:38 PM CVSS metrics ("Cvssv4 score" set to 9.3) CVSS metrics ("Cvssv4 threat vector" set to "CVSS:4.0/E:A") CVSS metrics ("Cvssv4 vector" set to "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N") Plugin metadata Plugin Feed: 202501222038
Version 1.2 Feb 9, 2024, 11:26 PM CEA reference Plugin Feed: 202402092326
Version 1.1 Oct 31, 2023, 8:15 PM CEA reference Plugin Feed: 202310312015
Version 1.0 Oct 31, 2023, 10:11 AM New Plugin Feed: 202310311011