The version of Jetty installed on the remote host suffers from a flaw where the buffer is not correctly recycled in Gzip request inflation. This may permit an attacker to inject data into the body of the subsequent request Note that the scanner has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:2517 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution     designed for on-premise or private cloud deployments.

    This advisory contains the RPM packages for Red Hat OpenShift Container Platform 3.11.462. See the     following advisory for the container images for this release:

    https://access.redhat.com/errata/RHBA-2021:2516

    Space precludes documenting all of the bug fixes and enhancements in this advisory. See the following     Release Notes documentation, which will be updated shortly for this release, for details about these     changes:

    https://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html

    All OpenShift Container Platform 3.11 users are advised to upgrade to these updated packages and images.

    Security Fix(es):

    * jenkins-2-plugins/config-file-provider: Does not configure its XML parser to prevent XML external entity     (XXE) attacks. (CVE-2021-21642)

    * jetty: local temporary directory hijacking vulnerability (CVE-2020-27216)

    * jetty: buffer not correctly recycled in Gzip Request inflation (CVE-2020-27218)

    * jetty: request containing multiple Accept headers with a large number of quality parameters may lead     to DoS (CVE-2020-27223)

    * jenkins-2-plugins/config-file-provider: Does not correctly perform permission checks in several HTTP     endpoints. (CVE-2021-21643)

    * jenkins-2-plugins/config-file-provider: does not require POST requests for an HTTP endpoint, resulting     in a cross-site request forgery (CSRF) vulnerability. (CVE-2021-21644)

    * jenkins-2-plugins/config-file-provider: Does not perform permission checks in several HTTP endpoints.
    (CVE-2021-21645)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:2431 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing     Kubernetes application platform solution designed for on-premise or private     cloud deployments.

    This advisory contains the RPM packages for Red Hat OpenShift Container     Platform 4.5.41. See the following advisory for the container images for     this release:

    https://access.redhat.com/errata/RHSA-2021:2430

    Security Fix(es):

    * jenkins-2-plugins/config-file-provider: Does not configure its XML parser to prevent XML external entity     (XXE) attacks. (CVE-2021-21642)

    * jetty: local temporary directory hijacking vulnerability (CVE-2020-27216)

    * jetty: buffer not correctly recycled in Gzip Request inflation (CVE-2020-27218)

    * jetty: request containing multiple Accept headers with a large number of quality parameters may lead     to DoS (CVE-2020-27223)

    * jenkins-2-plugins/config-file-provider: Does not correctly perform permission checks in several HTTP     endpoints. (CVE-2021-21643)

    * jenkins-2-plugins/config-file-provider: does not require POST requests for an HTTP endpoint, resulting     in a cross-site request forgery (CSRF) vulnerability. (CVE-2021-21644)

    * jenkins-2-plugins/config-file-provider: Does not perform permission checks in several HTTP endpoints.
    (CVE-2021-21645)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * Placeholder bug for OCP 4.5.41 rpm release (BZ#1972114)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3641 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3641-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                      Markus Koschany     October 30, 2023                              https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : jetty9     Version        : 9.4.50-4+deb10u1     CVE ID         : CVE-2020-27218 CVE-2023-36478 CVE-2023-44487     Debian Bug     : 976211

    Two remotely exploitable security vulnerabilities were discovered in Jetty 9,     a Java based web server and servlet engine.

    The HTTP/2 protocol implementation did not sufficiently verify if HPACK header     values exceed their size limit. Furthermore the HTTP/2 protocol allowed a     denial of service (server resource consumption) because request cancellation     can reset many streams quickly. This problem is also known as Rapid Reset     Attack.

    In addition this version also addresses CVE-2020-27218.

    If GZIP request body inflation is enabled and requests from different clients     are multiplexed onto a single connection, and if an attacker can send a request     with a body that is received entirely but not consumed by the application, then     a subsequent request on the same connection will see that body prepended to its     body. The attacker will not see any data but may inject data into the body of     the subsequent request.

    For Debian 10 buster, these problems have been fixed in version     9.4.50-4+deb10u1.

    We recommend that you upgrade your jetty9 packages.

    For the detailed security status of jetty9 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/jetty9

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: This is a digitally signed message part

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for jetty-minimal fixes the following issues :

  - jetty-minimal was upgraded to version 9.4.35.v20201120

  - CVE-2020-27218: Fixed an issue where buffer not     correctly recycled in Gzip Request inflation     (bsc#1179727).

This update was imported from the SUSE:SLE-15-SP2:Update update project.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2021:2499 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing     Kubernetes application platform solution designed for on-premise or private     cloud deployments.

    This advisory contains the RPM packages for Red Hat OpenShift Container     Platform 4.6.36. See the following advisory for the container images for     this release:

    https://access.redhat.com/errata/RHBA-2021:2498

    Security Fix(es):

    * jetty: local temporary directory hijacking vulnerability (CVE-2020-27216)

    * jetty: buffer not correctly recycled in Gzip Request inflation (CVE-2020-27218)

    * jetty: request containing multiple Accept headers with a large number of quality parameters may lead     to DoS (CVE-2020-27223)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - jetty: local temporary directory hijacking vulnerability (CVE-2020-27216)

  - jetty: buffer not correctly recycled in Gzip Request inflation (CVE-2020-27218)

  - Jetty is a Java based web server and servlet engine. Prior to versions 9.4.52, 10.0.16, 11.0.16, and     12.0.1, Jetty accepts the `+` character proceeding the content-length value in a HTTP/1 header field. This     is more permissive than allowed by the RFC and other servers routinely reject such requests with 400     responses. There is no known exploit scenario, but it is conceivable that request smuggling could result     if jetty is used in combination with a server that does not close the connection after sending such a 400     response. Versions 9.4.52, 10.0.16, 11.0.16, and 12.0.1 contain a patch for this issue. There is no     workaround as there is no known exploit scenario. (CVE-2023-40167)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

ID	Name	Product	Family	Published	Updated	Severity
113000	Jetty 10.0.0 < 10.0.0.beta3 Information Disclosure	Web App Scanning	Component Vulnerability	10/4/2021	3/14/2023	medium
113001	Jetty 11.0.0 < 11.0.0.beta3 Information Disclosure	Web App Scanning	Component Vulnerability	10/4/2021	3/14/2023	medium
112999	Jetty 9.4.x < 9.4.35 Information Disclosure	Web App Scanning	Component Vulnerability	10/4/2021	3/14/2023	medium
151276	RHEL 7 : OpenShift Container Platform 3.11.462 (RHSA-2021:2517)	Nessus	Red Hat Local Security Checks	7/1/2021	11/7/2024	high
151290	RHEL 7 : OpenShift Container Platform 4.5.41 (RHSA-2021:2431)	Nessus	Red Hat Local Security Checks	7/2/2021	11/7/2024	high
184061	Debian dla-3641 : jetty9 - security update	Nessus	Debian Local Security Checks	10/31/2023	1/22/2025	critical
145377	openSUSE Security Update : jetty-minimal (openSUSE-2021-12)	Nessus	SuSE Local Security Checks	1/25/2021	1/26/2024	medium
151117	RHEL 8 : OpenShift Container Platform 4.6.36 (RHSA-2021:2499)	Nessus	Red Hat Local Security Checks	6/29/2021	11/7/2024	high
199245	RHEL 8 : jetty (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	6/3/2024	7/12/2024	high

Detections

Analytics

Plugins Search

medium

medium

medium

high

high

critical

medium

high

high