CVE-2017-7656
Jetty vulnerable to cache poisoning due to inconsistent HTTP request handling (HTTP Request Smuggling)
Also known as GHSA-84q7-p226-4x5w
Published 8 y ago · modified 4 mo ago · JSON
Summary
In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), HTTP/0.9 is handled poorly. An HTTP/1 style request line (i.e. method space URI space version) that declares a version of HTTP/0.9 was accepted and treated as a 0.9 request. If deployed behind an intermediary that also accepted and passed through the 0.9 version (but did not act on it), then the response sent could be interpreted by the intermediary as HTTP/1 headers. This could be used to poison the cache if the server allowed the origin client to generate arbitrary content in the response.
Exploit prediction (EPSS)
6.11% probability of exploitation in the next 30 days, higher than 93% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 7.5 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:N/I:P/A:N |
| GitHub | 3.0 | 7.5 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.eclipse.jetty:jetty-server | <9.3.24.v20180605 >=9.4.0, <9.4.11.v20180605 | 9.3.24.v20180605 9.4.11.v20180605 |
Affected products
- The Eclipse Foundation Eclipse Jetty
Classification
- Weakness
- CWE-444 Inconsistent Interpretation of HTTP Requests
References
- debian.org /security/2018/dsa-4278 · vendor-advisory, x_refsource_DEBIAN, x_transferred
- securitytracker.com /id/1041194 · vdb-entry, x_refsource_SECTRACK, x_transferred
- lists.apache.org /thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451%40%3Csolr-user.lucen · mailing-list, x_refsource_MLIST, x_transferred
- lists.apache.org /thread.html/053d9ce4d579b02203db18545fee5e33f35f2932885459b74d1e4272%40%3Cissues.activemq · mailing-list, x_refsource_MLIST, x_transferred
- lists.apache.org /thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe%40%3Ccommits.druid.a · mailing-list, x_refsource_MLIST, x_transferred
- oracle.com /technetwork/security-advisory/cpuoct2019-5072832.html · x_refsource_MISC, x_transferred
- lists.apache.org /thread.html/rbf4565a0b63f9c8b07fab29352a97bbffe76ecafed8b8555c15b83c6%40%3Cissues.maven.a · mailing-list, x_refsource_MLIST, x_transferred
- oracle.com /security-alerts/cpuoct2020.html · x_refsource_MISC, x_transferred
- bugs.eclipse.org /bugs/show_bug.cgi?id=535667 · x_refsource_CONFIRM, x_transferred
- security.netapp.com /advisory/ntap-20181014-0001/ · x_refsource_CONFIRM, x_transferred
- support.hpe.com /hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03953en_us · x_refsource_CONFIRM, x_transferred
- oracle.com //security-alerts/cpujul2021.html · x_refsource_MISC, x_transferred
- nvd.nist.gov /vuln/detail/CVE-2017-7656 · advisory
- github.com /advisories/GHSA-84q7-p226-4x5w · advisory
- lists.apache.org /thread.html/053d9ce4d579b02203db18545fee5e33f35f2932885459b74d1e4272@%3Cissues.activemq.a · web
- lists.apache.org /thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451@%3Csolr-user.lucene. · web
- lists.apache.org /thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe@%3Ccommits.druid.apa · web
- lists.apache.org /thread.html/rbf4565a0b63f9c8b07fab29352a97bbffe76ecafed8b8555c15b83c6@%3Cissues.maven.apa · web
- security.netapp.com /advisory/ntap-20181014-0001 · web
Sources
- CVE List: CVE-2017-7656
- GitHub Advisory: GHSA-84q7-p226-4x5w
- NVD: CVE-2017-7656
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.