CVE-2017-7658
The Eclipse Foundation Eclipse Jetty
CRITICAL 9.8
At a glance
- Source
- NVD
- EPSS
- EPSS 19.36 % · percentile 97 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- eclipse
- NVD status
- Modified
Description
In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), when presented with two content-lengths headers, Jetty ignored the second. When presented with a content-length and a chunked encoding header, the content-length was ignored (as per RFC 2616). If an intermediary decided on the shorter length, but still passed on the longer body, then body content could be interpreted by Jetty as a pipelined request. If the intermediary was imposing authorization, the fake pipelined request would bypass that authorization.
Weaknesses (CWE)
- CWE-444 — Inconsistent Interpretation of HTTP Requests
References
- https://www.debian.org/security/2018/dsa-4278
- http://www.securitytracker.com/id/1041194
- http://www.securityfocus.com/bid/106566
- https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451%40%3Csolr-user.lucene.apache.org%3E
- https://lists.apache.org/thread.html/053d9ce4d579b02203db18545fee5e33f35f2932885459b74d1e4272%40%3Cissues.activemq.apache.org%3E
- https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe%40%3Ccommits.druid.apache.org%3E
- https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
- https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
- https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://security.netapp.com/advisory/ntap-20181014-0001/
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03953en_us
- https://bugs.eclipse.org/bugs/show_bug.cgi?id=535669
- https://lists.apache.org/thread.html/ra6f956ed4ec2855583b2d0c8b4802b450f593d37b77509b48cd5d574%40%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/r41af10c4adec8d34a969abeb07fd0d6ad0c86768b751464f1cdd23e8%40%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/r9159c9e7ec9eac1613da2dbaddbc15691a13d4dbb2c8be974f42e6ae%40%3Ccommits.druid.apache.org%3E
- https://www.oracle.com//security-alerts/cpujul2021.html
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | CRITICAL 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | HIGH 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P | NVD · nvd@nist.gov (Primary) |
Advisories
- GHSA-6x9x-8qw9-9pp6 — Jetty vulnerable to authorization bypass due to inconsistent HTTP request handling (HTTP Request Smuggling)
European references
- ENISA EUVD · EUVD-2018-0526
- GCVE · GCVE-0-2017-7658
CERT-FR advisories
- CERTFR-2026-AVI-0627 — Multiples vulnérabilités dans les produits Splunk · cert.ssi.gouv.fr
- CERTFR-2023-AVI-0357 — Multiples vulnérabilités dans IBM Cognos · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*≤ 9.2.26cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*≥ 9.3.0 < 9.3.24cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*≥ 9.4.0 < 9.4.11cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:rest_data_services:11.2.0.4:*:*:*:-:*:*:*cpe:2.3:a:oracle:rest_data_services:12.1.0.2:*:*:*:-:*:*:*cpe:2.3:a:oracle:rest_data_services:12.2.0.1:*:*:*:-:*:*:*cpe:2.3:a:oracle:rest_data_services:18c:*:*:*:-:*:*:*cpe:2.3:a:oracle:retail_xstore_payment:3.3:*:*:*:*:*:*:*cpe:2.3:a:oracle:retail_xstore_point_of_service:7.1:*:*:*:*:*:*:*cpe:2.3:a:oracle:retail_xstore_point_of_service:15.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0:*:*:*:*:*:*:*cpe:2.3:a:hp:xp_p9000_command_view:*:*:*:*:advanced:*:*:*≥ 8.4.0-00 ≤ 8.6.2-00cpe:2.3:a:netapp:e-series_santricity_management:-:*:*:*:*:*:*:*cpe:2.3:a:netapp:e-series_santricity_os_controller:*:*:*:*:*:*:*:*≥ 11.0 ≤ 11.50.1cpe:2.3:a:netapp:e-series_santricity_web_services:-:*:*:*:*:*:*:*cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:*cpe:2.3:a:netapp:hci_storage_node:-:*:*:*:*:*:*:*cpe:2.3:a:netapp:oncommand_system_manager:*:*:*:*:*:*:*:*≥ 3.0 ≤ 3.1.3cpe:2.3:a:netapp:oncommand_unified_manager_for_7-mode:-:*:*:*:*:*:*:*cpe:2.3:a:netapp:santricity_cloud_connector:-:*:*:*:*:*:*:*cpe:2.3:a:netapp:snap_creator_framework:-:*:*:*:*:*:*:*cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:*cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:oracle:*:*cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:sap:*:*cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:*cpe:2.3:a:netapp:storage_services_connector:-:*:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| The Eclipse Foundation · Eclipse Jetty | affected unspecified < 9.2.25 ; affected 9.3.0 < unspecified ; affected unspecified < 9.3.24 ; affected 9.4.0 < unspecified ; affected unspecified < 9.4.11 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |