Critical Buffer Release Vulnerability in Jetty9 Affects Multiple Debian Versions
Summary
DEBIAN-CVE-2024-13009: In Eclipse Jetty versions 9.4.0 to 9.4.56 a buffer can be incorrectly released when confronted with a gzip error when inflating a request body. Affects jetty9 versions < 9.4.57-0+deb11u1. Fixed in 9.4.57-0+deb11u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jetty9 is a widely used Java-based web server and servlet container that provides a robust platform for serving web applications. It is known for its scalability, lightweight architecture, and support for asynchronous processing. However, versions 9.4.0 to 9.4.56 of Jetty9 are vulnerable to a critical issue where a buffer can be incorrectly released when encountering a gzip error during the inflation of a request body. This vulnerability can lead to data corruption and unintended data sharing between requests, posing significant security risks.
Vulnerability Detail
In Eclipse Jetty versions 9.4.0 to 9.4.56, a buffer release issue occurs when the server encounters a gzip error while inflating a request body. This flaw can lead to corrupted data and the inadvertent sharing of sensitive information between different requests. The vulnerability stems from improper handling of gzip errors, which can compromise the integrity of the data being processed. Attackers could exploit this vulnerability to manipulate or access sensitive information, making it critical to address.
How To Fix
Minimum fixed version
9.4.57-0+deb11u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade jetty9Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, it is advisable to disable gzip compression for request bodies until the patch is applied. This can be done by modifying the Jetty configuration to prevent gzip encoding.
Conclusion
The buffer release vulnerability in Jetty9 poses significant risks to applications running affected versions. It is crucial to update to the latest patched versions to mitigate these risks. Additionally, utilizing tools like Vulert can help in monitoring and managing open-source vulnerabilities effectively.
See every vulnerability recorded for jetty9 →
FAQ
Eclipse Jetty versions 9.4.0 to 9.4.56 are affected by this vulnerability.
The vulnerability can lead to data corruption and unintended sharing of sensitive information between requests, which could be exploited by attackers.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
Yes, temporarily disabling gzip compression for request bodies can serve as a workaround until the patch is applied.
Regularly update your Jetty9 installation to the latest patched version and monitor for any new vulnerabilities using tools like Vulert.
References
Related vulnerabilities
Recent vulnerabilities recorded for jetty9.
