CVE-2020-27218: 
Java vulnerability analysis and mitigation

CVE-2020-27218 affects Eclipse Jetty versions 9.4.0.RC0 to 9.4.34.v20201102, 10.0.0.alpha0 to 10.0.0.beta2, and 11.0.0.alpha0 to 11.0.0.beta2. The vulnerability was discovered in November 2020 and received a CVSS v3.1 base score of 4.8 (Medium) (NVD, Eclipse Bug).

The vulnerability occurs when GZIP request body inflation is enabled and requests from different clients are multiplexed onto a single connection. If an attacker can send a request with a body that is received entirely but not consumed by the application, then a subsequent request on the same connection will see that body prepended to its body. The vulnerability has been assigned CWE-226 and has a CVSS v3.1 score of 4.8 with vector AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L (Eclipse Bug, GitHub Advisory).

While the attacker will not see any data, they may inject data into the body of subsequent requests from other clients on the same connection. This could potentially lead to request tampering and data injection attacks (GitHub Advisory).

The vulnerability requires high attack complexity but can be exploited remotely without authentication. The attacker needs to be able to send a request with a body that is received but not consumed by the application (NVD).

The vulnerability was patched in versions 9.4.35.v20201120, 10.0.0.beta3, and 11.0.0.beta3. Workarounds include: disabling compressed request body inflation by GzipHandler, always fully consuming the request content before sending a response, or adding a Connection: close header to responses where the servlet does not fully consume request content (GitHub Advisory).

Multiple organizations and projects had to update their Jetty dependencies to address this vulnerability, including Apache Kafka, Apache Spark, and Apache HBase. NetApp issued an advisory for their products affected by this vulnerability (NetApp Advisory).