-------------------------------------------------------------------------
Debian LTS Advisory DLA-3641-1                debian-lts@lists.debian.org
https://www.debian.org/lts/security/                      Markus Koschany
October 30, 2023                              https://wiki.debian.org/LTS
-------------------------------------------------------------------------

Package        : jetty9
Version        : 9.4.50-4+deb10u1
CVE ID         : CVE-2020-27218 CVE-2023-36478 CVE-2023-44487
Debian Bug     : 976211

Two remotely exploitable security vulnerabilities were discovered in Jetty 9,
a Java based web server and servlet engine.

The HTTP/2 protocol implementation did not sufficiently verify if HPACK header
values exceed their size limit. Furthermore the HTTP/2 protocol allowed a
denial of service (server resource consumption) because request cancellation
can reset many streams quickly. This problem is also known as Rapid Reset   
Attack.

In addition this version also addresses CVE-2020-27218.

If GZIP request body inflation is enabled and requests from different clients
are multiplexed onto a single connection, and if an attacker can send a request
with a body that is received entirely but not consumed by the application, then
a subsequent request on the same connection will see that body prepended to its
body. The attacker will not see any data but may inject data into the body of
the subsequent request.

For Debian 10 buster, these problems have been fixed in version
9.4.50-4+deb10u1.

We recommend that you upgrade your jetty9 packages.

For the detailed security status of jetty9 please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/source-package/jetty9

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS