CVE-2020-27223

Published Feb 26, 2021

Last updated 9 months ago

Overview

Description
In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept headers with a large number of “quality” (i.e. q) parameters, the server may enter a denial of service (DoS) state due to high CPU usage processing those quality values, resulting in minutes of CPU time exhausted processing those quality values.
Source
emo@eclipse.org
NVD status
Modified
Products
jetty, nifi, spark, e-series_santricity_os_controller, e-series_santricity_web_services, element_plug-in_for_vcenter_server, hci, hci_management_node, management_services_for_element_software, snap_creator_framework, snapcenter, snapmanager, solidfire, debian_linux, solr, rest_data_services

Risk scores

CVSS 3.1

Type
Primary
Base score
5.3
Impact score
1.4
Exploitability score
3.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Severity
MEDIUM

CVSS 2.0

Type
Primary
Base score
4.3
Impact score
2.9
Exploitability score
8.6
Vector string
AV:N/AC:M/Au:N/C:N/I:N/A:P

Weaknesses

emo@eclipse.org
CWE-407
nvd@nist.gov
CWE-400

Social media

Hype score
Not currently trending

Configurations

References

Sources include official advisories and independent security research.