Skip to content
OpenAdvisories
High · 7.0 CVE-2020-27216 EUVD-2020-1455GHSA-g3wg-6mcf-8jj6

Local Temp Directory Hijacking Vulnerability

Published Oct 23, 2020 · Updated Aug 4, 2024 · Assigned by eclipse

Description

In Eclipse Jetty versions 1.0 thru 9.4.32.v20200930, 10.0.0.alpha1 thru 10.0.0.beta2, and 11.0.0.alpha1 thru 11.0.0.beta2O, on Unix like systems, the system's temporary directory is shared between all users on that system. A collocated user can observe the process of creating a temporary sub directory in the shared temporary directory and race to complete the creation of the temporary subdirectory. If the attacker wins the race then they will have read and write permission to the subdirectory used to unpack web applications, including their WEB-INF/lib jar files and JSP files. If any code is ever executed out of this temporary directory, this can lead to a local privilege escalation vulnerability.

Affected products

VendorProductAffectedFixed
The Eclipse Foundation Eclipse Jetty 1.0 to 9.4.32.v20200930, 10.0.0.alpha1 to 10.0.0.beta2, 11.0.0.alpha1 to 11.0.0.beta2 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 jetty9 9.4.33-1 —
Debian 13 jetty9 9.4.33-1 —
Debian 12 jetty9 9.4.33-1 —
Debian 10 jetty9 9.4.16-0+deb10u1 DSA-4949-1
Debian 9 jetty9 9.2.30-0+deb9u1 DLA-2661-1
ReleasePackageFixed inAdvisory
Ubuntu 20.04 LTS jetty9 No fix yet —
Ubuntu 18.04 LTS jetty9 No fix yet —
Ubuntu 16.04 LTS jetty +2 No fix yet —
Ubuntu 14.04 LTS jetty +1 No fix yet —
ReleasePackageFixed inAdvisory
Red Hat OpenShift 4 jenkins 2.277.3.1623846768-1.el7 RHSA-2021:2499, RHSA-2021:2431
Red Hat OpenShift 4 jenkins-2-plugins 4.5.1623326336-1.el7 RHSA-2021:2431
Red Hat OpenShift 3 jenkins 2.289.1.1624365627-1.el7 RHSA-2021:2517
Red Hat OpenShift 3 jenkins-2-plugins 3.11.1624366838-1.el7 RHSA-2021:2517
Red Hat Devtools 2020 rh-eclipse +2 1:4.17-6.el7_9 RHSA-2020:5168
Red Hat Devtools 2020 rh-eclipse-ant +23 1.10.9-1.2.el7 RHSA-2020:5168
Red Hat Devtools 2020 rh-eclipse-antlr32 +4 3.2-28.1.el7 RHSA-2020:5168
Red Hat Devtools 2020 rh-eclipse-apache-sshd +1 1:2.4.0-5.1.el7 RHSA-2020:5168
Red Hat Devtools 2020 rh-eclipse-apiguardian +3 1.1.0-6.1.el7 RHSA-2020:5168
Red Hat Devtools 2020 rh-eclipse-args4j +2 2.33-12.2.el7 RHSA-2020:5168
Red Hat Devtools 2020 rh-eclipse-batik +9 1.13-1.1.el7 RHSA-2020:5168
Red Hat Devtools 2020 rh-eclipse-bouncycastle +5 1.67-1.1.el7 RHSA-2020:5168
Red Hat Devtools 2020 rh-eclipse-cbi-plugins +1 1.1.7-8.1.el7 RHSA-2020:5168
Red Hat Devtools 2020 rh-eclipse-decentxml +1 1.4-24.1.el7 RHSA-2020:5168
Red Hat Devtools 2020 rh-eclipse-ecj 1:4.17-1.1.el7 RHSA-2020:5168
Red Hat Devtools 2020 rh-eclipse-eclipse +7 1:4.17-2.2.el7_9 RHSA-2020:5168
Red Hat Devtools 2020 rh-eclipse-eclipse-ecf +3 3.14.17-1.1.el7 RHSA-2020:5168
Red Hat Devtools 2020 rh-eclipse-eclipse-egit +1 5.9.0-1.1.el7_9 RHSA-2020:5168
Red Hat Devtools 2020 rh-eclipse-eclipse-emf +4 1:2.23.0-1.1.el7 RHSA-2020:5168
Red Hat Devtools 2020 rh-eclipse-eclipse-gef +1 3.11.0-14.1.el7 RHSA-2020:5168
Red Hat Devtools 2020 rh-eclipse-eclipse-license +1 2.0.2-2.1.el7_9 RHSA-2020:5168
Red Hat Devtools 2020 rh-eclipse-eclipse-license1 1.0.1-12.1.el7_9 RHSA-2020:5168
Red Hat Devtools 2020 rh-eclipse-eclipse-m2e-core 1.16.2-3.1.el7_9 RHSA-2020:5168
Red Hat Devtools 2020 rh-eclipse-eclipse-m2e-workspace +1 0.4.0-16.1.el7 RHSA-2020:5168
Red Hat Devtools 2020 rh-eclipse-eclipse-mpc 1.8.4-1.1.el7 RHSA-2020:5168
Red Hat Devtools 2020 rh-eclipse-eclipse-pydev 1:8.0.0-1.1.el7_9 RHSA-2020:5168
Red Hat Devtools 2020 rh-eclipse-eclipse-subclipse 4.3.0-8.1.el7_9 RHSA-2020:5168
Red Hat Devtools 2020 rh-eclipse-eclipse-webtools +3 3.19.0-1.1.el7_9 RHSA-2020:5168
Red Hat Devtools 2020 rh-eclipse-ed25519-java 0.3.0-8.2.el7 RHSA-2020:5168
Red Hat Devtools 2020 rh-eclipse-felix-gogo-command +1 1.0.2-12.1.el7 RHSA-2020:5168
Red Hat Devtools 2020 rh-eclipse-felix-gogo-parent 4-6.1.el7 RHSA-2020:5168
Red Hat Devtools 2020 rh-eclipse-felix-gogo-runtime +1 1.1.0-8.1.el7 RHSA-2020:5168
Red Hat Devtools 2020 rh-eclipse-felix-scr +1 2.1.16-7.2.el7 RHSA-2020:5168
Red Hat Devtools 2020 rh-eclipse-javaewah +1 1.1.6-10.1.el7 RHSA-2020:5168
Red Hat Devtools 2020 rh-eclipse-javaparser +1 3.14.16-1.2.el7 RHSA-2020:5168
Red Hat Devtools 2020 rh-eclipse-jchardet +1 1.1-23.1.el7 RHSA-2020:5168
Red Hat Devtools 2020 rh-eclipse-jctools +1 3.1.0-1.1.el7 RHSA-2020:5168
Red Hat Devtools 2020 rh-eclipse-jetty +13 9.4.33-1.1.el7 RHSA-2020:5168
Red Hat Devtools 2020 rh-eclipse-jffi +2 1.2.23-2.1.el7 RHSA-2020:5168
Red Hat Devtools 2020 rh-eclipse-jgit +1 5.9.0-1.2.el7 RHSA-2020:5168
Red Hat Devtools 2020 rh-eclipse-jna +2 5.4.0-7.1.el7 RHSA-2020:5168
Red Hat Devtools 2020 rh-eclipse-jnr-constants +1 0.9.12-7.1.el7 RHSA-2020:5168
Red Hat Devtools 2020 rh-eclipse-jnr-ffi +1 2.1.8-9.1.el7 RHSA-2020:5168
Red Hat Devtools 2020 rh-eclipse-jnr-netdb +1 1.1.6-11.1.el7 RHSA-2020:5168
Red Hat Devtools 2020 rh-eclipse-jnr-posix +1 3.0.47-7.1.el7 RHSA-2020:5168
Red Hat Devtools 2020 rh-eclipse-jnr-x86asm +1 1.0.2-22.1.el7 RHSA-2020:5168
Red Hat Devtools 2020 rh-eclipse-jsch-agent-proxy +9 0.0.8-14.1.el7 RHSA-2020:5168
Red Hat Devtools 2020 rh-eclipse-junit5 +2 5.7.0-1.2.el7 RHSA-2020:5168
Red Hat Devtools 2020 rh-eclipse-jython +2 2.7.1-14.1.el7_9 RHSA-2020:5168
Red Hat Devtools 2020 rh-eclipse-jzlib +2 1.1.3-15.1.el7 RHSA-2020:5168
Red Hat Devtools 2020 rh-eclipse-lucene +16 8.6.3-1.1.el7 RHSA-2020:5168
Red Hat Devtools 2020 rh-eclipse-maven-archetype +6 3.2.0-1.1.el7_9 RHSA-2020:5168
Red Hat Devtools 2020 rh-eclipse-maven-indexer +1 6.0.0-5.1.el7 RHSA-2020:5168
Red Hat Devtools 2020 rh-eclipse-netty 4.1.51-1.2.el7 RHSA-2020:5168
Red Hat Devtools 2020 rh-eclipse-objectweb-asm +1 8.0.1-1.2.el7 RHSA-2020:5168
Red Hat Devtools 2020 rh-eclipse-opentest4j +1 1.2.0-4.1.el7 RHSA-2020:5168
Red Hat Devtools 2020 rh-eclipse-os-maven-plugin +1 1.6.2-2.1.el7 RHSA-2020:5168
Red Hat Devtools 2020 rh-eclipse-sac +1 1.3-34.1.el7 RHSA-2020:5168
Red Hat Devtools 2020 rh-eclipse-sat4j 2.3.5-20.1.el7 RHSA-2020:5168
Red Hat Devtools 2020 rh-eclipse-sequence-library +1 1.0.3-8.1.el7 RHSA-2020:5168
Red Hat Devtools 2020 rh-eclipse-sqljet +1 1.1.10-18.1.el7 RHSA-2020:5168
Red Hat Devtools 2020 rh-eclipse-stringtemplate +1 3.2.1-24.1.el7 RHSA-2020:5168
Red Hat Devtools 2020 rh-eclipse-svnkit +3 1:1.8.12-9.1.el7 RHSA-2020:5168
Red Hat Devtools 2020 rh-eclipse-takari-polyglot +6 0.4.5-2.1.el7_9 RHSA-2020:5168
Red Hat Devtools 2020 rh-eclipse-trilead-ssh2 +1 217.21-3.1.el7 RHSA-2020:5168
Red Hat Devtools 2020 rh-eclipse-tycho +1 1.7.0-2.5.el7_9 RHSA-2020:5168
Red Hat Devtools 2020 rh-eclipse-univocity-parsers +1 2.9.0-1.1.el7 RHSA-2020:5168
Red Hat Devtools 2020 rh-eclipse-ws-commons-util +1 1.0.2-14.1.el7 RHSA-2020:5168
Red Hat Devtools 2020 rh-eclipse-xml-maven-plugin +1 1.0.2-7.1.el7 RHSA-2020:5168
Red Hat Devtools 2020 rh-eclipse-xmlgraphics-commons +1 2.4-1.1.el7 RHSA-2020:5168
Red Hat Devtools 2020 rh-eclipse-xmlrpc +4 1:3.1.3-27.1.el7 RHSA-2020:5168

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.eclipse.jetty:jetty-webapp < 9.4.33.v20201020 9.4.33.v20201020 GHSA-g3wg-6mcf-8jj6
Maven org.eclipse.jetty:jetty-webapp >= 10.0.0.beta1, < 10.0.0.beta3 10.0.0.beta3 GHSA-g3wg-6mcf-8jj6
Maven org.eclipse.jetty:jetty-webapp >= 11.0.0.beta1, < 11.0.0.beta3 11.0.0.beta3 GHSA-g3wg-6mcf-8jj6
Maven org.mortbay.jetty:jetty-webapp < 9.4.33 9.4.33 GHSA-g3wg-6mcf-8jj6
Maven org.mortbay.jetty:jetty-webapp >= 10.0.0.beta1, < 10.0.0.beta3 10.0.0.beta3 GHSA-g3wg-6mcf-8jj6
Maven org.mortbay.jetty:jetty-webapp >= 11.0.0.beta1, < 11.0.0.beta3 11.0.0.beta3 GHSA-g3wg-6mcf-8jj6

Advisories 8

References