NetSight
IP …
medium5.3

CVE-2020-27223

DOS vulnerability for Quoted Quality CSV headers

Impact

### Impact When Jetty handles a request containing request headers with a large number of “quality” (i.e. q) parameters (such as what are seen on the `Accept`, `Accept-Encoding`, and `Accept-Language` request headers), the server may enter a denial of service (DoS) state due to high CPU usage while sorting the list of values based on their quality values. A single request can easily consume minutes of CPU time before it is even dispatched to the application. The only features within Jetty that can trigger this behavior are: - Default Error Handling - the `Accept` request header with the `QuotedQualityCSV` is used to determine what kind of content to send back to the client (html, text, json, xml, etc) - `StatisticsServlet` - uses the `Accept` request header with the `QuotedQualityCSV` to determine what kind of content to send back to the client (xml, json, text, html, etc) - `HttpServletRequest.getLocale()` - uses the `Accept-Language` request header with the `QuotedQualityCSV` to determine which “preferred” language is returned on this call. - `HttpservletRequest.getLocales()` - is similar to the above, but returns an ordered list of locales based on the quality values on the `Accept-Language` request header. - `DefaultServlet` - uses the `Accept-Encoding` request header with the `QuotedQualityCSV` to determine which kind of pre-compressed content should be sent back for static content (content that is not matched against a url-pattern in your web app) ### Versions `QuotedQualityCSV` was introduced to Jetty 9.3.9.v20160517 and the bug that introduced the vulnerability was in 9.4.6.v20170531. Currently, known vulnerable versions include: - 9.4.6.v20170531 thru to 9.4.36.v20210114 - 10.0.0 - 11.0.0 ### Workarounds Quality ordered values are used infrequently by jetty so they can be avoided by: * Do not use the default error page/handler. * Do not deploy the `StatisticsServlet` exposed to the network * Do not call `getLocale` API * Do not enable precompressed static content in the `DefaultServlet` ### Patches All patches are available for download from the Eclipse Jetty website at [https://www.eclipse.org/jetty/download.php](https://www.eclipse.org/jetty/download.php) - 9.4.37.v20210219 and greater - 10.0.1 and greater - 11.0.1 and greater

Affected packages

EcosystemPackageAffectedFixed in
mavenorg.eclipse.jetty:jetty-server>= 9.4.6, < 9.4.379.4.37

Affected products

VendorProductAffected versions
EclipseJetty
from 9.4.7 before 9.4.36
Versions 9.4.6, 9.4.36, 10.0.0, 11.0.0
ApacheNifi
Version 1.13.0
ApacheSpark
Version 3.1.1
NetappE-Series Santricity Os Controller
from 11.0.0 through 11.70.1
NetappE-Series Santricity Web Services
All versions
NetappElement Plug-In For Vcenter Server
All versions
NetappHci
All versions
NetappHci Management Node
All versions
NetappManagement Services For Element Software
All versions
NetappSnap Creator Framework
All versions
NetappSnapcenter
All versions
NetappSnapmanager
All versions

Weakness classification

CWE-407CWE-400

References