CVE-2019-17638
published 2020-07-09CVE-2019-17638: In Eclipse Jetty, versions 9.4.27.v20200227 to 9.4.29.v20200521, in case of too large response headers, Jetty throws an exception to produce an HTTP 431 error…
PriorityP259critical9.4CVSS 3.1
AVNACLPRNUINSUCHIHAL
EPSS
11.14%
95.5th percentile
In Eclipse Jetty, versions 9.4.27.v20200227 to 9.4.29.v20200521, in case of too large response headers, Jetty throws an exception to produce an HTTP 431 error. When this happens, the ByteBuffer containing the HTTP response headers is released back to the ByteBufferPool twice. Because of this double release, two threads can acquire the same ByteBuffer from the pool and while thread1 is about to use the ByteBuffer to write response1 data, thread2 fills the ByteBuffer with other data. Thread1 then proceeds to write the buffer that now contains different data. This results in client1, which issued request1 seeing data from another request or response which could contain sensitive data belonging to client2 (HTTP session ids, authentication credentials, etc.). If the Jetty version cannot be upgraded, the vulnerability can be significantly reduced by configuring a responseHeaderSize significantly larger than the requestHeaderSize (12KB responseHeaderSize and 8KB requestHeaderSize).
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | jetty9 | < jetty9 9.4.31-1 (bookworm) | jetty9 9.4.31-1 (bookworm) |
| eclipse | jetty | — | — |
| eclipse | jetty | — | — |
| eclipse | jetty | — | — |
| jenkins | jenkins_core | — | — |
| jenkins | jenkins_lts | — | — |
| jenkins | jenkins_weekly | — | — |
| the_eclipse_foundation | eclipse_jetty | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Trigger condition: sending HTTP request headers large enough to cause Jetty to return HTTP 431 (Request Header Fields Too Large) can expose response data from other clients due to ByteBuffer double-release race condition ↗
- →Sensitive data leakage observable in HTTP responses: watch for HTTP session IDs or authentication credentials appearing in responses to unrelated requests, indicating ByteBuffer cross-contamination ↗
- →Affected Jenkins versions (core, bundled Jetty 9.4.27): Jenkins weekly 2.224–2.242 and LTS 2.222.1–2.235.4 are vulnerable; unauthenticated exploitation possible over HTTP ↗
- →Affected Jetty version range: 9.4.27.v20200227 through 9.4.29.v20200521; flag any server advertising these Jetty versions in HTTP Server headers ↗
- →Exploitation vector is remote, unauthenticated, over HTTP — no authentication required to trigger the vulnerability ↗
- ·Mitigation (not a fix): set responseHeaderSize significantly larger than requestHeaderSize to reduce exploitation likelihood — recommended values are 12KB responseHeaderSize and 8KB requestHeaderSize ↗
- ·Jenkins instances started via 'java -jar jenkins.war' (installers/packages) are affected; instances deployed in servlet containers such as Tomcat are NOT affected by the bundled Jetty vulnerability ↗
CVSS provenance
nvdv3.19.4CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv9.4CRITICAL
vendor_debian9.4CRITICAL
vendor_oracle9.4CRITICAL
vendor_redhat9.4CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Operation on a Resource after Expiration or Release in Jetty Server
ghsa·2020-08-05
CVE-2019-17638 [CRITICAL] CWE-672 Operation on a Resource after Expiration or Release in Jetty Server
Operation on a Resource after Expiration or Release in Jetty Server
In Eclipse Jetty, versions 9.4.27.v20200227 to 9.4.29.v20200521, in case of too large response headers, Jetty throws an exception to produce an HTTP 431 error. When this happens, the ByteBuffer containing the HTTP response headers is released back to the ByteBufferPool twice. Because of this double release, two threads can acquire the same ByteBuffer from the pool and while thread1 is about to use the ByteBuffer to write response1 data, thread2 fills the ByteBuffer with response2 data. Thread1 then proceeds to write the buffer that now contains response2 data. This results in client1, which issued request1 and expects responses, to see response2 which could contain sensitive data belonging to client2 (HTTP session ids, au
OSV
Operation on a Resource after Expiration or Release in Jetty Server
osv·2020-08-05
CVE-2019-17638 [CRITICAL] Operation on a Resource after Expiration or Release in Jetty Server
Operation on a Resource after Expiration or Release in Jetty Server
In Eclipse Jetty, versions 9.4.27.v20200227 to 9.4.29.v20200521, in case of too large response headers, Jetty throws an exception to produce an HTTP 431 error. When this happens, the ByteBuffer containing the HTTP response headers is released back to the ByteBufferPool twice. Because of this double release, two threads can acquire the same ByteBuffer from the pool and while thread1 is about to use the ByteBuffer to write response1 data, thread2 fills the ByteBuffer with response2 data. Thread1 then proceeds to write the buffer that now contains response2 data. This results in client1, which issued request1 and expects responses, to see response2 which could contain sensitive data belonging to client2 (HTTP session ids, au
OSV
CVE-2019-17638: In Eclipse Jetty, versions 9
osv·2020-07-09·CVSS 9.4
CVE-2019-17638 [CRITICAL] CVE-2019-17638: In Eclipse Jetty, versions 9
In Eclipse Jetty, versions 9.4.27.v20200227 to 9.4.29.v20200521, in case of too large response headers, Jetty throws an exception to produce an HTTP 431 error. When this happens, the ByteBuffer containing the HTTP response headers is released back to the ByteBufferPool twice. Because of this double release, two threads can acquire the same ByteBuffer from the pool and while thread1 is about to use the ByteBuffer to write response1 data, thread2 fills the ByteBuffer with other data. Thread1 then proceeds to write the buffer that now contains different data. This results in client1, which issued request1 seeing data from another request or response which could contain sensitive data belonging to client2 (HTTP session ids, authentication credentials, etc.). If the Jetty version cannot be upgr
Oracle
Oracle Oracle Financial Services Applications Risk Matrix: Demographics (Eclipse Jetty) — CVE-2019-17638
vendor_oracle·2021-04-15·CVSS 9.4
CVE-2019-17638 [CRITICAL] Oracle Oracle Financial Services Applications Risk Matrix: Demographics (Eclipse Jetty) — CVE-2019-17638
Oracle Oracle Financial Services Applications Risk Matrix: Demographics (Eclipse Jetty) vulnerability
CVE: CVE-2019-17638
CVSS: 9.4
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpuapr2021 (APR 2021)
Oracle
Oracle Oracle Communications Risk Matrix: WS and WEB (Eclipse Jetty) — CVE-2019-17638
vendor_oracle·2020-10-15·CVSS 9.4
CVE-2019-17638 [CRITICAL] Oracle Oracle Communications Risk Matrix: WS and WEB (Eclipse Jetty) — CVE-2019-17638
Oracle Oracle Communications Risk Matrix: WS and WEB (Eclipse Jetty) vulnerability
CVE: CVE-2019-17638
CVSS: 9.4
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpuoct2020 (OCT 2020)
Jenkins
Jenkins Security Advisory 2020-08-17
vendor_jenkins·2020-08-17·CVSS 9.4
CVE-2019-17638 [CRITICAL] Jenkins Security Advisory 2020-08-17
Title: Jenkins Security Advisory 2020-08-17
Jenkins Security Advisory 2020-08-17
Jenkins Security Home
For Administrators
Overview
Terminology
Vulnerabilities and Scoring
Security Advisories
Security Issues
Advisory Schedule
Vulnerabilities in Plugins
How We Fix Security Issues
For Reporters
Reporting Vulnerabilities
Jenkins CNA
For Maintainers
Overview
Vulnerabilities in Plugins
Jenkins Security Team
About
Contributions
This advisory announces vulnerabilities in the following Jenkins deliverables:
Jenkins (core)
Descriptions
Buffer corruption in bundled Jetty
SECURITY-1983
/
CVE-2019-17638
Severity (CVSS):
Critical
Description:
Jenkins bundles Winstone-Jetty, a wrapper ar
Red Hat
jetty: double release of resource can lead to information disclosure
vendor_redhat·2020-06-03·CVSS 9.4
CVE-2019-17638 [CRITICAL] CWE-1341 jetty: double release of resource can lead to information disclosure
jetty: double release of resource can lead to information disclosure
In Eclipse Jetty, versions 9.4.27.v20200227 to 9.4.29.v20200521, in case of too large response headers, Jetty throws an exception to produce an HTTP 431 error. When this happens, the ByteBuffer containing the HTTP response headers is released back to the ByteBufferPool twice. Because of this double release, two threads can acquire the same ByteBuffer from the pool and while thread1 is about to use the ByteBuffer to write response1 data, thread2 fills the ByteBuffer with other data. Thread1 then proceeds to write the buffer that now contains different data. This results in client1, which issued request1 seeing data from another request or response which could contain sensitive data belonging to client2 (HTTP session ids,
Debian
CVE-2019-17638: jetty9 - In Eclipse Jetty, versions 9.4.27.v20200227 to 9.4.29.v20200521, in case of too ...
vendor_debian·2019·CVSS 9.4
CVE-2019-17638 [CRITICAL] CVE-2019-17638: jetty9 - In Eclipse Jetty, versions 9.4.27.v20200227 to 9.4.29.v20200521, in case of too ...
In Eclipse Jetty, versions 9.4.27.v20200227 to 9.4.29.v20200521, in case of too large response headers, Jetty throws an exception to produce an HTTP 431 error. When this happens, the ByteBuffer containing the HTTP response headers is released back to the ByteBufferPool twice. Because of this double release, two threads can acquire the same ByteBuffer from the pool and while thread1 is about to use the ByteBuffer to write response1 data, thread2 fills the ByteBuffer with other data. Thread1 then proceeds to write the buffer that now contains different data. This results in client1, which issued request1 seeing data from another request or response which could contain sensitive data belonging to client2 (HTTP session ids, authentication credentials, etc.). If the Jetty version cannot be upgr
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2019-17638 jetty: double release of resource can lead to information disclosure [fedora-all]
bugzilla·2020-08-03·CVSS 9.4
CVE-2019-17638 [CRITICAL] CVE-2019-17638 jetty: double release of resource can lead to information disclosure [fedora-all]
CVE-2019-17638 jetty: double release of resource can lead to information disclosure [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple
Bugzilla
CVE-2019-17638 jetty: double release of resource can lead to information disclosure
bugzilla·2020-08-03·CVSS 9.4
CVE-2019-17638 [CRITICAL] CVE-2019-17638 jetty: double release of resource can lead to information disclosure
CVE-2019-17638 jetty: double release of resource can lead to information disclosure
In Eclipse Jetty, versions 9.4.27.v20200227 to 9.4.29.v20200521, in case of too large response headers, Jetty throws an exception to produce an HTTP 431 error. When this happens, the ByteBuffer containing the HTTP response headers is released back to the ByteBufferPool twice. Because of this double release, two threads can acquire the same ByteBuffer from the pool and while thread1 is about to use the ByteBuffer to write response1 data, thread2 fills the ByteBuffer with response2 data. Thread1 then proceeds to write the buffer that now contains response2 data. This results in client1, which issued request1 and expects responses, to see response2 which could contain sensitive data belonging to client2 (HTTP
Checkpoint
24th August – Threat Intelligence Bulletin
blogs_checkpoint·2020-08-24
CVE-2020-1530 24th August – Threat Intelligence Bulletin
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 24th August – Threat Intelligence Bulletin
For the latest discoveries in cyber research for the week of 24th August 2020, please download our Threat Intelligence Bulletin .
Top Attacks and Breaches
The University of Utah has paid $457K to prevent attackers from publishing student and employee information stolen during a ransomware attack which ended on July 19 th . The ransom has been paid by the university’s cyber insurer.
Taiwan has blamed four Chinese APT groups: Blacktech, Taidoor, MustangPanda and APT40 f
http://www.openwall.com/lists/oss-security/2020/08/17/1https://bugs.eclipse.org/bugs/show_bug.cgi?id=564984https://lists.apache.org/thread.html/r29073905dc9139d0d7a146595694bf57bb9e35e5ec6aa73eb9c8443a%40%3Ccommits.pulsar.apache.org%3Ehttps://lists.apache.org/thread.html/r378e4cdec15e132575aa1dcb6296ffeff2a896745a8991522e266ad4%40%3Ccommits.pulsar.apache.org%3Ehttps://lists.apache.org/thread.html/r4bdd3f7bb6820a79f9416b6667d718a06d269018619a75ce4b759318%40%3Ccommits.pulsar.apache.org%3Ehttps://lists.apache.org/thread.html/r521168299e023fb075b57afe33d17ff1d09e8a10e0fd8c775ea0e028%40%3Ccommits.pulsar.apache.org%3Ehttps://lists.apache.org/thread.html/r7fc5f2ed49641ea91c433e3cd0fc3d31c0278c87b82b15c33b881415%40%3Ccommits.pulsar.apache.org%3Ehttps://lists.apache.org/thread.html/r81f58591fb4716fb867b36956f30c7c8ad4ab3f23abc952d9d86a2a0%40%3Ccommits.pulsar.apache.org%3Ehttps://lists.apache.org/thread.html/r9584c4304c888f651d214341a939bd264ed30c9e3d0d30fe85097ecf%40%3Ccommits.pulsar.apache.org%3Ehttps://lists.apache.org/thread.html/r9a2cfa56d30782a0c17a5deb951a622d1f5c8de48e1c3b578ffc2a84%40%3Ccommits.pulsar.apache.org%3Ehttps://lists.apache.org/thread.html/ra8661fc8c69c647cb06153c1485d48484a833d873f75dfe45937e9de%40%3Ccommits.pulsar.apache.org%3Ehttps://lists.apache.org/thread.html/rbe1f230e87ea947593145d0072d0097ddb0af10fee1161db8ca1546c%40%3Ccommits.pulsar.apache.org%3Ehttps://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3Ehttps://lists.apache.org/thread.html/rd98cfd012490cb02caa1a11aaa0cc38bff2d43bcce9b20c2f01063dd%40%3Ccommits.pulsar.apache.org%3Ehttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XE6US6VPZHOWFMUSFGDS5V2DNQPY5MKB/https://www.oracle.com/security-alerts/cpuApr2021.htmlhttps://www.oracle.com/security-alerts/cpuoct2020.htmlhttp://www.openwall.com/lists/oss-security/2020/08/17/1https://bugs.eclipse.org/bugs/show_bug.cgi?id=564984https://lists.apache.org/thread.html/r29073905dc9139d0d7a146595694bf57bb9e35e5ec6aa73eb9c8443a%40%3Ccommits.pulsar.apache.org%3Ehttps://lists.apache.org/thread.html/r378e4cdec15e132575aa1dcb6296ffeff2a896745a8991522e266ad4%40%3Ccommits.pulsar.apache.org%3Ehttps://lists.apache.org/thread.html/r4bdd3f7bb6820a79f9416b6667d718a06d269018619a75ce4b759318%40%3Ccommits.pulsar.apache.org%3Ehttps://lists.apache.org/thread.html/r521168299e023fb075b57afe33d17ff1d09e8a10e0fd8c775ea0e028%40%3Ccommits.pulsar.apache.org%3Ehttps://lists.apache.org/thread.html/r7fc5f2ed49641ea91c433e3cd0fc3d31c0278c87b82b15c33b881415%40%3Ccommits.pulsar.apache.org%3Ehttps://lists.apache.org/thread.html/r81f58591fb4716fb867b36956f30c7c8ad4ab3f23abc952d9d86a2a0%40%3Ccommits.pulsar.apache.org%3Ehttps://lists.apache.org/thread.html/r9584c4304c888f651d214341a939bd264ed30c9e3d0d30fe85097ecf%40%3Ccommits.pulsar.apache.org%3Ehttps://lists.apache.org/thread.html/r9a2cfa56d30782a0c17a5deb951a622d1f5c8de48e1c3b578ffc2a84%40%3Ccommits.pulsar.apache.org%3Ehttps://lists.apache.org/thread.html/ra8661fc8c69c647cb06153c1485d48484a833d873f75dfe45937e9de%40%3Ccommits.pulsar.apache.org%3Ehttps://lists.apache.org/thread.html/rbe1f230e87ea947593145d0072d0097ddb0af10fee1161db8ca1546c%40%3Ccommits.pulsar.apache.org%3Ehttps://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3Ehttps://lists.apache.org/thread.html/rd98cfd012490cb02caa1a11aaa0cc38bff2d43bcce9b20c2f01063dd%40%3Ccommits.pulsar.apache.org%3Ehttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XE6US6VPZHOWFMUSFGDS5V2DNQPY5MKB/https://www.oracle.com/security-alerts/cpuApr2021.htmlhttps://www.oracle.com/security-alerts/cpuoct2020.html
2020-07-09
Published