Critical severity vulnerability that affects org.eclipse.jetty:jetty-server

Also known as GHSA-vgg8-72f2-qm23

Published 8 y ago 2018-06-26 · modified 4 mo ago 2026-06-17 · JSON

CVSS

9.8

v3.1 · NVD

CISA KEV

not known exploited

EPSS

14.4%

percentile 97%

Public exploits

none known

In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), transfer-encoding chunks are handled poorly. The chunk length parsing was vulnerable to an integer overflow. Thus a large chunk size could be interpreted as a smaller chunk size and content sent as chunk body could be interpreted as a pipelined request. If Jetty was deployed behind an intermediary that imposed some authorization and that intermediary allowed arbitrarily large chunks to be passed on unchanged, then this flaw could be used to bypass the authorization imposed by the intermediary as the fake pipelined request would not be interpreted by the intermediary as a request.

Exploit prediction (EPSS)

14.37% probability of exploitation in the next 30 days, higher than 97% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
NVD	3.1	9.8	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`
NVD	2.0	7.5	`AV:N/AC:L/Au:N/C:P/I:P/A:P`
GitHub	3.1	9.8	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`

Affected packages

Ecosystem	Package	Affected	Fixed in
maven	`org.eclipse.jetty:jetty-server`	<9.2.25.v20180606 >=9.3.0, <9.3.24.v20180605	9.2.25.v20180606 9.3.24.v20180605

Affected products

The Eclipse Foundation Eclipse Jetty

Classification

Weakness

CWE-444 Inconsistent Interpretation of HTTP Requests
CWE-190 Integer Overflow or Wraparound

References

debian.org /security/2018/dsa-4278 · vendor-advisory, x_refsource_DEBIAN, x_transferred
securitytracker.com /id/1041194 · vdb-entry, x_refsource_SECTRACK, x_transferred
lists.apache.org /thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451%40%3Csolr-user.lucen · mailing-list, x_refsource_MLIST, x_transferred
access.redhat.com /errata/RHSA-2019:0910 · vendor-advisory, x_refsource_REDHAT, x_transferred
lists.apache.org /thread.html/053d9ce4d579b02203db18545fee5e33f35f2932885459b74d1e4272%40%3Cissues.activemq · mailing-list, x_refsource_MLIST, x_transferred
lists.apache.org /thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe%40%3Ccommits.druid.a · mailing-list, x_refsource_MLIST, x_transferred
oracle.com /technetwork/security-advisory/cpuoct2019-5072832.html · x_refsource_MISC, x_transferred
lists.apache.org /thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkee · mailing-list, x_refsource_MLIST, x_transferred
oracle.com /security-alerts/cpuoct2020.html · x_refsource_MISC, x_transferred
security.netapp.com /advisory/ntap-20181014-0001/ · x_refsource_CONFIRM, x_transferred
support.hpe.com /hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03953en_us · x_refsource_CONFIRM, x_transferred
bugs.eclipse.org /bugs/show_bug.cgi?id=535668 · x_refsource_CONFIRM, x_transferred
lists.apache.org /thread.html/ra6f956ed4ec2855583b2d0c8b4802b450f593d37b77509b48cd5d574%40%3Ccommits.druid. · mailing-list, x_refsource_MLIST, x_transferred
lists.apache.org /thread.html/r41af10c4adec8d34a969abeb07fd0d6ad0c86768b751464f1cdd23e8%40%3Ccommits.druid. · mailing-list, x_refsource_MLIST, x_transferred
lists.apache.org /thread.html/r9159c9e7ec9eac1613da2dbaddbc15691a13d4dbb2c8be974f42e6ae%40%3Ccommits.druid. · mailing-list, x_refsource_MLIST, x_transferred
oracle.com //security-alerts/cpujul2021.html · x_refsource_MISC, x_transferred
nvd.nist.gov /vuln/detail/CVE-2017-7657 · advisory
github.com /advisories/GHSA-vgg8-72f2-qm23 · advisory
lists.apache.org /thread.html/053d9ce4d579b02203db18545fee5e33f35f2932885459b74d1e4272@%3Cissues.activemq.a · web
lists.apache.org /thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451@%3Csolr-user.lucene. · web
lists.apache.org /thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe@%3Ccommits.druid.apa · web
lists.apache.org /thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0@%3Cissues.bookkeepe · web
lists.apache.org /thread.html/r41af10c4adec8d34a969abeb07fd0d6ad0c86768b751464f1cdd23e8@%3Ccommits.druid.ap · web
lists.apache.org /thread.html/r9159c9e7ec9eac1613da2dbaddbc15691a13d4dbb2c8be974f42e6ae@%3Ccommits.druid.ap · web
lists.apache.org /thread.html/ra6f956ed4ec2855583b2d0c8b4802b450f593d37b77509b48cd5d574@%3Ccommits.druid.ap · web
security.netapp.com /advisory/ntap-20181014-0001 · web

Sources

CVE List: CVE-2017-7657
GitHub Advisory: GHSA-vgg8-72f2-qm23
NVD: CVE-2017-7657

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary