CVE-2024-13009: Eclipse Jetty GZIP buffer release
In Eclipse Jetty versions 9.4.0 to 9.4.56 a buffer can be incorrectly released when confronted with a gzip error when inflating a request body. This can result in corrupted and/or inadvertent sharing of data between requests.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.eclipse.jetty:jetty-serverto a version that resolves this vulnerability.Fixed in 9.4.57.v20241219 - Upgrade
Upgrade
Eclipse Jettyto a version that resolves this vulnerability.Fixed in 9.4.57 - Compensating control
If upgrading Jetty to a version outside 9.4.0–9.4.56 is not immediately possible, mitigate by placing network/WAF controls to limit or filter requests with gzip-encoded bodies that could trigger the gzip-inflation error condition.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-13009?
CVE-2024-13009 has a medium severity rating due to the potential for data corruption and inadvertent sharing between requests.
How do I fix CVE-2024-13009?
To fix CVE-2024-13009, update Eclipse Jetty to a version beyond 9.4.56.
What versions of Eclipse Jetty are affected by CVE-2024-13009?
Eclipse Jetty versions from 9.4.0 to 9.4.56 are affected by CVE-2024-13009.
What issues arise from CVE-2024-13009?
CVE-2024-13009 can lead to corrupted data and inadvertent data sharing between requests due to incorrect buffer handling.
Is CVE-2024-13009 a threat to production systems?
Yes, CVE-2024-13009 poses a risk to production systems that rely on the affected versions of Eclipse Jetty.