CVE:CVE-2020-27218
CNNVD:CNNVD-202011-2020
Eclipse Jetty是Eclipse基金会的一个开源的、基于Java的Web服务器和Java Servlet容器。
Eclipse Jetty 存在安全漏洞，该漏洞源于如果启用GZIP请求主体的通货膨胀和来自不同客户端的请求多路复用到一个连接, 攻击者可利用该漏洞可以发送一个请求接收到的身体完全但不被应用程序,然后后续请求在同一连接会发现身体返回它的body。以下产品及版本受到影响：9.4.0.RC0版本至9.4.34.v20201102版本, 10.0.0.alpha0版本至 10.0.0.beta2版本,11.0.0.alpha0版本 11.0.0.beta2版本。
solution:Upgrade eclipse jetty to a higher version than 9.4.35,10.0.0:alpha0,10.0.0:alpha1,10.0.0:beta0,10.0.0:beta1,10.0.0:beta2,11.0.0:alpha0,11.0.0:beta1,11.0.0:beta2,and avoid the version [9.4.0,9.4.35),10.0.0:alpha0,10.0.0:alpha1,10.0.0:beta0,10.0.0:beta1,10.0.0:beta2,11.0.0:alpha0,11.0.0:beta1,11.0.0:beta2; Upgrade netapp oncommand_system_manager to a higher version than 3.1.3,and avoid the version [3.0,3.1.3]; Upgrade netapp snap_creator_framework to a higher version than -; Upgrade oracle blockchain_platform to a higher version than 21.1.2,and avoid the version (,21.1.2); Upgrade oracle communications_converged_application_server_-_service_controller to a higher version than 6.2,and avoid the version 6.2; Upgrade oracle communications_offline_mediation_controller to a higher version than 12.0.0.3.0,and avoid the version 12.0.0.3.0; Upgrade oracle communications_pricing_design_center to a higher version than 12.0.0.3.0,and avoid the version 12.0.0.3.0; Upgrade oracle communications_services_gatekeeper to a higher version than 7.0,and avoid the version 7.0; Upgrade oracle communications_session_route_manager to a higher version than 8.2.4,and avoid the version [8.0.0,8.2.4]; Upgrade oracle flexcube_private_banking to a higher version than 12.0.0,12.1.0,and avoid the version 12.0.0,12.1.0; Upgrade oracle hyperion_infrastructure_technology to a higher version than 11.1.2.6.0,and avoid the version 11.1.2.6.0; Upgrade oracle rest_data_services to a higher version than 20.4.3.050.1904,and avoid the version (,20.4.3.050.1904); Upgrade oracle retail_eftlink to a higher version than 20.0.0,and avoid the version 20.0.0; Upgrade oracle siebel_core_-_automation to a higher version than 21.5,and avoid the version (,21.5]; Upgrade apache kafka to a higher version than 2.7.0,and avoid the version 2.7.0; Upgrade apache spark to a higher version than 2.4.8,3.0.3,and avoid the version 2.4.8,3.0.3