CVE-2017-7656
The Eclipse Foundation Eclipse Jetty
HIGH 7.5
At a glance
- Source
- NVD
- EPSS
- EPSS 6.33 % · percentile 94 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- eclipse
- NVD status
- Modified
Description
In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), HTTP/0.9 is handled poorly. An HTTP/1 style request line (i.e. method space URI space version) that declares a version of HTTP/0.9 was accepted and treated as a 0.9 request. If deployed behind an intermediary that also accepted and passed through the 0.9 version (but did not act on it), then the response sent could be interpreted by the intermediary as HTTP/1 headers. This could be used to poison the cache if the server allowed the origin client to generate arbitrary content in the response.
Weaknesses (CWE)
- CWE-444 — Inconsistent Interpretation of HTTP Requests
References
- https://www.debian.org/security/2018/dsa-4278
- http://www.securitytracker.com/id/1041194
- https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451%40%3Csolr-user.lucene.apache.org%3E
- https://lists.apache.org/thread.html/053d9ce4d579b02203db18545fee5e33f35f2932885459b74d1e4272%40%3Cissues.activemq.apache.org%3E
- https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe%40%3Ccommits.druid.apache.org%3E
- https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
- https://lists.apache.org/thread.html/rbf4565a0b63f9c8b07fab29352a97bbffe76ecafed8b8555c15b83c6%40%3Cissues.maven.apache.org%3E
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://bugs.eclipse.org/bugs/show_bug.cgi?id=535667
- https://security.netapp.com/advisory/ntap-20181014-0001/
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03953en_us
- https://www.oracle.com//security-alerts/cpujul2021.html
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.0 | HIGH 7.5 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | MEDIUM 5.0 | AV:N/AC:L/Au:N/C:N/I:P/A:N | NVD · nvd@nist.gov (Primary) |
Advisories
- GHSA-84q7-p226-4x5w — Jetty vulnerable to cache poisoning due to inconsistent HTTP request handling (HTTP Request Smuggling)
European references
- ENISA EUVD · EUVD-2018-0544
- GCVE · GCVE-0-2017-7656
CERT-FR advisories
- CERTFR-2026-AVI-0627 — Multiples vulnérabilités dans les produits Splunk · cert.ssi.gouv.fr
- CERTFR-2023-AVI-0357 — Multiples vulnérabilités dans IBM Cognos · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*≤ 9.2.26cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*≥ 9.3.0 < 9.3.24cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*≥ 9.4.0 < 9.4.11cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| The Eclipse Foundation · Eclipse Jetty | affected unspecified ≤ 9.2.0 ; affected 9.3.0 < unspecified ; affected unspecified < 9.3.24 ; affected 9.4.0 < unspecified ; affected unspecified < 9.4.11 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |