CVE-2017-7658
The Eclipse Foundation Eclipse Jetty
CRITICAL 9.8
En bref
- Source
- NVD
- EPSS
- EPSS 19.36 % · centile 97 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- eclipse
- Statut NVD
- Modified
Description
In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), when presented with two content-lengths headers, Jetty ignored the second. When presented with a content-length and a chunked encoding header, the content-length was ignored (as per RFC 2616). If an intermediary decided on the shorter length, but still passed on the longer body, then body content could be interpreted by Jetty as a pipelined request. If the intermediary was imposing authorization, the fake pipelined request would bypass that authorization.
Faiblesses (CWE)
- CWE-444 — Dissimulation de requête ou de réponse HTTP
Références
- https://www.debian.org/security/2018/dsa-4278
- http://www.securitytracker.com/id/1041194
- http://www.securityfocus.com/bid/106566
- https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451%40%3Csolr-user.lucene.apache.org%3E
- https://lists.apache.org/thread.html/053d9ce4d579b02203db18545fee5e33f35f2932885459b74d1e4272%40%3Cissues.activemq.apache.org%3E
- https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe%40%3Ccommits.druid.apache.org%3E
- https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
- https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
- https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://security.netapp.com/advisory/ntap-20181014-0001/
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03953en_us
- https://bugs.eclipse.org/bugs/show_bug.cgi?id=535669
- https://lists.apache.org/thread.html/ra6f956ed4ec2855583b2d0c8b4802b450f593d37b77509b48cd5d574%40%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/r41af10c4adec8d34a969abeb07fd0d6ad0c86768b751464f1cdd23e8%40%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/r9159c9e7ec9eac1613da2dbaddbc15691a13d4dbb2c8be974f42e6ae%40%3Ccommits.druid.apache.org%3E
- https://www.oracle.com//security-alerts/cpujul2021.html
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | CRITICAL 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | HIGH 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P | NVD · nvd@nist.gov (Primary) |
Avis
- GHSA-6x9x-8qw9-9pp6 — Jetty vulnerable to authorization bypass due to inconsistent HTTP request handling (HTTP Request Smuggling)
Références européennes
- ENISA EUVD · EUVD-2018-0526
- GCVE · GCVE-0-2017-7658
Avis du CERT-FR
- CERTFR-2026-AVI-0627 — Multiples vulnérabilités dans les produits Splunk · cert.ssi.gouv.fr
- CERTFR-2023-AVI-0357 — Multiples vulnérabilités dans IBM Cognos · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*≤ 9.2.26cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*≥ 9.3.0 < 9.3.24cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*≥ 9.4.0 < 9.4.11cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:rest_data_services:11.2.0.4:*:*:*:-:*:*:*cpe:2.3:a:oracle:rest_data_services:12.1.0.2:*:*:*:-:*:*:*cpe:2.3:a:oracle:rest_data_services:12.2.0.1:*:*:*:-:*:*:*cpe:2.3:a:oracle:rest_data_services:18c:*:*:*:-:*:*:*cpe:2.3:a:oracle:retail_xstore_payment:3.3:*:*:*:*:*:*:*cpe:2.3:a:oracle:retail_xstore_point_of_service:7.1:*:*:*:*:*:*:*cpe:2.3:a:oracle:retail_xstore_point_of_service:15.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0:*:*:*:*:*:*:*cpe:2.3:a:hp:xp_p9000_command_view:*:*:*:*:advanced:*:*:*≥ 8.4.0-00 ≤ 8.6.2-00cpe:2.3:a:netapp:e-series_santricity_management:-:*:*:*:*:*:*:*cpe:2.3:a:netapp:e-series_santricity_os_controller:*:*:*:*:*:*:*:*≥ 11.0 ≤ 11.50.1cpe:2.3:a:netapp:e-series_santricity_web_services:-:*:*:*:*:*:*:*cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:*cpe:2.3:a:netapp:hci_storage_node:-:*:*:*:*:*:*:*cpe:2.3:a:netapp:oncommand_system_manager:*:*:*:*:*:*:*:*≥ 3.0 ≤ 3.1.3cpe:2.3:a:netapp:oncommand_unified_manager_for_7-mode:-:*:*:*:*:*:*:*cpe:2.3:a:netapp:santricity_cloud_connector:-:*:*:*:*:*:*:*cpe:2.3:a:netapp:snap_creator_framework:-:*:*:*:*:*:*:*cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:*cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:oracle:*:*cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:sap:*:*cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:*cpe:2.3:a:netapp:storage_services_connector:-:*:*:*:*:*:*:*
Produits affectés
| Produit | Versions |
|---|---|
| The Eclipse Foundation · Eclipse Jetty | affected unspecified < 9.2.25 ; affected 9.3.0 < unspecified ; affected unspecified < 9.3.24 ; affected 9.4.0 < unspecified ; affected unspecified < 9.4.11 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |