CVE-2024-13009

NameCVE-2024-13009
DescriptionIn Eclipse Jetty versions 9.4.0 to 9.4.56 a buffer can be incorrectly released when confronted with a gzip error when inflating a request body. This can result in corrupted and/or inadvertent sharing of data between requests.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-4106-1, DSA-5894-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
jetty12 (PTS)sid, trixie12.0.17-3fixed
jetty9 (PTS)bullseye9.4.50-4+deb11u2vulnerable
bullseye (security)9.4.57-0+deb11u2fixed
bookworm9.4.50-4+deb12u3vulnerable
bookworm (security)9.4.57-0+deb12u1fixed
sid, trixie9.4.57-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
jettysource(unstable)(not affected)
jetty12source(unstable)(not affected)
jetty9sourcebullseye9.4.57-0+deb11u1DLA-4106-1
jetty9sourcebookworm9.4.57-0+deb12u1DSA-5894-1
jetty9source(unstable)9.4.57-1

Notes

- jetty12 <not-affected> (Only affects 9.x)
- jetty <not-affected> (Only affects 9.x)
https://github.com/jetty/jetty.project/security/advisories/GHSA-q4rv-gq96-w7c5
https://gitlab.eclipse.org/security/cve-assignement/-/issues/48

Search for package or bug name: Reporting problems