vulnwire
9.8crit

CVE-2017-7658in critical feed

Jetty vulnerable to authorization bypass due to inconsistent HTTP request handling (HTTP Request Smuggling)

Also known as GHSA-6x9x-8qw9-9pp6

Published 8 y ago · modified 4 mo ago · JSON

CVSS
9.8
v3.1 · NVD
CISA KEV
No
not known exploited
EPSS
19.0%
percentile 97%
Public exploits
0
none known

In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), when presented with two content-lengths headers, Jetty ignored the second. When presented with a content-length and a chunked encoding header, the content-length was ignored (as per RFC 2616). If an intermediary decided on the shorter length, but still passed on the longer body, then body content could be interpreted by Jetty as a pipelined request. If the intermediary was imposing authorization, the fake pipelined request would bypass that authorization.

Exploit prediction (EPSS)

19.00% probability of exploitation in the next 30 days, higher than 97% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.19.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD2.07.5AV:N/AC:L/Au:N/C:P/I:P/A:P
GitHub3.19.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

EcosystemPackageAffectedFixed in
mavenorg.eclipse.jetty:jetty-server
<9.2.25.v20180606
>=9.3.0, <9.3.24.v20180605
>=9.4.0, <9.4.11.v20180605
9.2.25.v20180606
9.3.24.v20180605
9.4.11.v20180605

Affected products

  • The Eclipse Foundation Eclipse Jetty

Classification

Weakness
  • CWE-444 Inconsistent Interpretation of HTTP Requests

References

  • debian.org /security/2018/dsa-4278 · vendor-advisory, x_refsource_DEBIAN, x_transferred
  • securitytracker.com /id/1041194 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • securityfocus.com /bid/106566 · vdb-entry, x_refsource_BID, x_transferred
  • lists.apache.org /thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451%40%3Csolr-user.lucen · mailing-list, x_refsource_MLIST, x_transferred
  • lists.apache.org /thread.html/053d9ce4d579b02203db18545fee5e33f35f2932885459b74d1e4272%40%3Cissues.activemq · mailing-list, x_refsource_MLIST, x_transferred
  • lists.apache.org /thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe%40%3Ccommits.druid.a · mailing-list, x_refsource_MLIST, x_transferred
  • oracle.com /technetwork/security-advisory/cpujan2019-5072801.html · x_refsource_CONFIRM, x_transferred
  • oracle.com /technetwork/security-advisory/cpuoct2019-5072832.html · x_refsource_MISC, x_transferred
  • lists.apache.org /thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkee · mailing-list, x_refsource_MLIST, x_transferred
  • oracle.com /security-alerts/cpuoct2020.html · x_refsource_MISC, x_transferred
  • security.netapp.com /advisory/ntap-20181014-0001/ · x_refsource_CONFIRM, x_transferred
  • support.hpe.com /hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03953en_us · x_refsource_CONFIRM, x_transferred
  • bugs.eclipse.org /bugs/show_bug.cgi?id=535669 · x_refsource_CONFIRM, x_transferred
  • lists.apache.org /thread.html/ra6f956ed4ec2855583b2d0c8b4802b450f593d37b77509b48cd5d574%40%3Ccommits.druid. · mailing-list, x_refsource_MLIST, x_transferred
  • lists.apache.org /thread.html/r41af10c4adec8d34a969abeb07fd0d6ad0c86768b751464f1cdd23e8%40%3Ccommits.druid. · mailing-list, x_refsource_MLIST, x_transferred
  • lists.apache.org /thread.html/r9159c9e7ec9eac1613da2dbaddbc15691a13d4dbb2c8be974f42e6ae%40%3Ccommits.druid. · mailing-list, x_refsource_MLIST, x_transferred
  • oracle.com //security-alerts/cpujul2021.html · x_refsource_MISC, x_transferred
  • nvd.nist.gov /vuln/detail/CVE-2017-7658 · advisory
  • github.com /advisories/GHSA-6x9x-8qw9-9pp6 · advisory
  • lists.apache.org /thread.html/053d9ce4d579b02203db18545fee5e33f35f2932885459b74d1e4272@%3Cissues.activemq.a · web
  • lists.apache.org /thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451@%3Csolr-user.lucene. · web
  • lists.apache.org /thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe@%3Ccommits.druid.apa · web
  • lists.apache.org /thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0@%3Cissues.bookkeepe · web
  • lists.apache.org /thread.html/r41af10c4adec8d34a969abeb07fd0d6ad0c86768b751464f1cdd23e8@%3Ccommits.druid.ap · web
  • lists.apache.org /thread.html/r9159c9e7ec9eac1613da2dbaddbc15691a13d4dbb2c8be974f42e6ae@%3Ccommits.druid.ap · web
  • lists.apache.org /thread.html/ra6f956ed4ec2855583b2d0c8b4802b450f593d37b77509b48cd5d574@%3Ccommits.druid.ap · web
  • security.netapp.com /advisory/ntap-20181014-0001 · web

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.