Vulnerability in Apache Kafka
CVE-2020-27218
In Eclipse Jetty version 9.4.0.RC0 to 9.4.34.v20201102, 10.0.0.alpha0 to 10.0.0.beta2, and 11.0.0.alpha0 to 11.0.0.beta2, if GZIP request body inflation is enabled and requests from different clients are multiplexed onto a single connection, and if an attacker can send a request with a body that is received entirely but not consumed by the application, then a subsequent request on the same connection will see that body prepended to its body. The attacker will not see any data but may inject data into the body of the subsequent request.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 4.8 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L.
EPSS exploit prediction
EPSS: 0.083 (94.9th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 95th percentile — 94.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.083 · newest: 0.083 · change: 0.000
Affected products
- Apache Kafka — versions 2.7.0
- Apache Spark — versions 2.4.8, 3.0.3
- Eclipse Jetty — versions 10.0.0, 11.0.0
- NetApp Oncommand System Manager
- NetApp Snap Creator Framework
- Oracle Blockchain Platform
- Oracle Communications Converged Application Server - Service Controller — versions 6.2
- Oracle Communications Offline Mediation Controller — versions 12.0.0.3.0
- Oracle Communications Pricing Design Center — versions 12.0.0.3.0
- Oracle Communications Services Gatekeeper — versions 7.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- bugs.eclipse.org/bugs/show_bug.cgi (Issue Tracking, Vendor Advisory)
- github.com/eclipse/jetty.project/security/advisories/GHSA-86wm-rrjm-8wh8 (Third Party Advisory)
- lists.apache.org/thread.html/r6d5bb60a13e8b539600f86cb72097967b951de5c7ef1e4005… (mailing-list, Issue Tracking)
- lists.apache.org/thread.html/r8fee46fd9f1254150cc55eecf1ea6a448fca1f7cf1d1e7f9c… (mailing-list, Issue Tracking)
- lists.apache.org/thread.html/rbc5a8d7a0a13bc8152d427a7e9097cdeb139c6cfe111b2f00… (mailing-list, Issue Tracking)
- lists.apache.org/thread.html/r8c839a0d88cd6504abbe72c260371094f47014b2ba08d8d2c… (mailing-list, Issue Tracking)
- lists.apache.org/thread.html/r22776d06582985cca5bd2a92519a2b13b4cae2d8e087318da… (mailing-list, Issue Tracking)
- lists.apache.org/thread.html/rfa8879a713480b206c152334419499e6af0878c36217abcc9… (mailing-list, Issue Tracking)
- lists.apache.org/thread.html/re86a6ba09dc74e709db843e3561ead923c8fd1cba32343656… (mailing-list, Issue Tracking)
- lists.apache.org/thread.html/r23ce6b8965e30808daa77a80fcd69833b1fc632d80465d041… (mailing-list, Issue Tracking)
Frequently asked questions
- What is CVE-2020-27218?
- CVE-2020-27218 is a medium-severity vulnerability in Apache Kafka, classified under Sensitive Information in Resource Not Removed Before Reuse. CVSS score: 4.8/10. Published 2020-11-28.
- How severe is CVE-2020-27218?
- Medium severity. CVSS v3 base score is 4.8 out of 10.
- Is CVE-2020-27218 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.