UBUNTU-CVE-2020-27216

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/CVE-2020-27216
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2020/UBUNTU-CVE-2020-27216.json
JSON Data
https://api.osv.dev/v1/vulns/UBUNTU-CVE-2020-27216
Related
Published
2020-10-23T13:15:00Z
Modified
2024-10-15T14:07:43Z
Severity
  • 7.0 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

In Eclipse Jetty versions 1.0 thru 9.4.32.v20200930, 10.0.0.alpha1 thru 10.0.0.beta2, and 11.0.0.alpha1 thru 11.0.0.beta2O, on Unix like systems, the system's temporary directory is shared between all users on that system. A collocated user can observe the process of creating a temporary sub directory in the shared temporary directory and race to complete the creation of the temporary subdirectory. If the attacker wins the race then they will have read and write permission to the subdirectory used to unpack web applications, including their WEB-INF/lib jar files and JSP files. If any code is ever executed out of this temporary directory, this can lead to a local privilege escalation vulnerability.

References

Affected packages

Ubuntu:Pro:14.04:LTS / jetty

Package

Name
jetty
Purl
pkg:deb/ubuntu/jetty?arch=src?distro=trusty/esm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

6.*

6.1.26-1ubuntu1
6.1.26-1ubuntu1.1
6.1.26-1ubuntu1.2

Ecosystem specific 

{
    "ubuntu_priority": "medium"
}

Ubuntu:Pro:14.04:LTS / jetty8

Package

Name
jetty8
Purl
pkg:deb/ubuntu/jetty8?arch=src?distro=trusty/esm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

8.*

8.1.3-8
8.1.3-9

Ecosystem specific 

{
    "ubuntu_priority": "medium"
}

Ubuntu:Pro:16.04:LTS / jetty

Package

Name
jetty
Purl
pkg:deb/ubuntu/jetty?arch=src?distro=esm-apps/xenial

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

6.*

6.1.26-5
6.1.26-5ubuntu0.1

Ecosystem specific 

{
    "ubuntu_priority": "medium"
}

Ubuntu:Pro:16.04:LTS / jetty8

Package

Name
jetty8
Purl
pkg:deb/ubuntu/jetty8?arch=src?distro=esm-apps/xenial

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

8.*

8.1.17-2
8.1.18-1
8.1.18-2
8.1.18-3
8.1.19-1

Ecosystem specific 

{
    "ubuntu_priority": "medium"
}

Ubuntu:Pro:16.04:LTS / jetty9

Package

Name
jetty9
Purl
pkg:deb/ubuntu/jetty9?arch=src?distro=esm-apps/xenial

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

9.*

9.2.14-1

Ecosystem specific 

{
    "ubuntu_priority": "medium"
}

Ubuntu:Pro:18.04:LTS / jetty9

Package

Name
jetty9
Purl
pkg:deb/ubuntu/jetty9?arch=src?distro=esm-apps/bionic

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

9.*

9.2.22-2
9.2.22-3
9.2.23-1
9.4.15-1~18.04.1ubuntu1

Ecosystem specific 

{
    "ubuntu_priority": "medium"
}

Ubuntu:20.04:LTS / jetty9

Package

Name
jetty9
Purl
pkg:deb/ubuntu/jetty9?arch=src?distro=focal

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

9.*

9.4.18-2build2
9.4.26-1

Ecosystem specific 

{
    "ubuntu_priority": "medium"
}