← back
CVE-2020-27223mediumCWE-407

CVE-2020-27223

35Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.2epss 78%
exploitation probability
78%top 1% of all CVEs
observed exploitation
nono source reports it
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Affected
8 products (52 components)
Red Hat Enterprise Linux 7 · Red Hat Enterprise Linux 8 · Red Hat OpenShift Container Platform 4 · Red Hat Enterprise Linux 6 · Red Hat Integration Camel Quarkus 1 · and others 3
no_fix_planned: Out of support scope
Fixed
10 products (24 components)
8Base-RHMTC-1.4 · Red Hat OpenShift Container Platform 3.11 · Red Hat OpenShift Container Platform 4.5 · Red Hat OpenShift Container Platform 4.6 · 7Server-RHMTC-1.4 · and others 5
fix ↗
Not affected
6 products (147 components) — because the vulnerable code is not present in the product
Red Hat OpenShift Container Platform 3.11 · Red Hat OpenShift Container Platform 4.5 · Red Hat OpenShift Container Platform 4.6 · Red Hat Decision Manager 7 · Red Hat Process Automation 7 · and others 1
In short

Eclipse Jetty servers can be made to consume excessive CPU time when processing HTTP requests with multiple Accept headers containing many quality parameters. This allows attackers to cause a denial of service by exhausting server resources.

Technical detail

CWE-407 (Inefficient Algorithmic Complexity) in Jetty versions 9.4.6 through 9.4.36, 10.0.0, and 11.0.0 allows remote attackers to trigger algorithmic complexity exploitation via crafted HTTP requests with multiple Accept headers containing numerous quality (q) parameters, resulting in prolonged CPU consumption and service unavailability.

Summary generated and translated by AI from the official description.
In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept headers with a large number of “quality” (i.e. q) parameters, the server may enter a denial of service (DoS) state due to high CPU usage processing those quality values, resulting in minutes of CPU time exhausted processing those quality values.
CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
Affected products
The Eclipse Foundation · Eclipse Jetty
References
https://bugs.eclipse.org/bugs/show_bug.cgi?id=571128https://github.com/eclipse/jetty.project/security/advisories/GHSA-m394-8rww-3jr7https://github.com/jetty/jetty.project/commit/10e531756b972162eed402c44d0244f7f6b85131https://lists.apache.org/thread.html/r068dfd35ce2193f6af28b74ff29ab148c2b2cacb235995576f5bea78%40%3Cissues.solr.apache.org%3Ehttps://lists.apache.org/thread.html/r07aedcb1ece62969c406cb84c8f0e22cec7e42cdc272f3176e473320%40%3Cusers.solr.apache.org%3Ehttps://lists.apache.org/thread.html/r0b639bd9bfaea265022125d18acd2fc6456044b76609ec74772c9567%40%3Cissues.zookeeper.apache.org%3Ehttps://lists.apache.org/thread.html/r0c6eced465950743f3041b03767a32b2e98d19731bd72277fc7ea428%40%3Ccommits.zookeeper.apache.org%3Ehttps://lists.apache.org/thread.html/r0cdab13815fc419805a332278c8d27e354e78560944fc36db0bdc760%40%3Cnotifications.zookeeper.apache.org%3Ehttps://lists.apache.org/thread.html/r0e25cdf3722a24c53049d37396f0da8502cb4b7cdc481650dc601dbc%40%3Cgitbox.activemq.apache.org%3Ehttps://lists.apache.org/thread.html/r105f4e52feb051faeb9141ef78f909aaf5129d6ed1fc52e099c79463%40%3Cissues.spark.apache.org%3Ehttps://lists.apache.org/thread.html/r1414ab2b3f4bb4c0e736caff6dc8d15f93f6264f0cca5c47710d7bb3%40%3Creviews.spark.apache.org%3Ehttps://lists.apache.org/thread.html/r1b7ed296a865e3f1337a96ee9cd51f6d154d881a30da36020ca72a4b%40%3Cjira.kafka.apache.org%3E