Cette page suit l'état du correctif pour Debian. La vulnérabilité elle-même est décrite sur la page CVE principale.
Voir CVE-2020-27223 →
DEBIAN-CVE-2020-27223
In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept headers w...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept headers with a large number of “quality” (i.e. q) parameters, the server may enter a denial of service (DoS) state due to high CPU usage processing those quality values, resulting in minutes of CPU time exhausted processing those quality values.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Paquets affectés
Debian:12
jetty9
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.38-1"}]}]
Debian:13
jetty9
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.38-1"}]}]
Debian:14
jetty9
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.38-1"}]}]
Références
- advisory security-tracker.debian.org