CVE-2017-7656 Jetty vulnerable to cache poisoning due to inconsistent HTTP request handling (HTTP Request Smuggling)
HighCVSS 7.5
EPSS 6.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), HTTP/0.9 is handled poorly. An HTTP/1 style request line (i.e. method space URI space version) that declares a version of HTTP/0.9 was accepted and treated as a 0.9 request. If deployed behind an intermediary that also accepted and passed through the 0.9 version (but did not act on it), then the response sent could be interpreted by the intermediary as HTTP/1 headers. This could be used to poison the cache if the server allowed the origin client to generate arbitrary content in the response.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.eclipse.jetty/jetty-server(Maven) | <= 9.3.23.v20180228 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | >= 9.4.0, <= 9.4.10.v20180503 | No fix listed |
| debian/jetty9(Debian:12) | < 9.2.25-1 | 9.2.25-1 |
| debian/jetty9(Debian:14) | < 9.2.25-1 | 9.2.25-1 |
| debian/jetty9(Debian:13) | < 9.2.25-1 | 9.2.25-1 |
| org.eclipse.jetty/jetty-server(Maven) | < 9.3.24.v20180605 | 9.3.24.v20180605 |
| org.eclipse.jetty/jetty-server(Maven) | = 7.0.0.M0 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.0.0.M1 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.0.0.M2 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.0.0.M3 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.0.0.M4 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.0.0.RC0 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.0.0.RC1 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.0.0.RC2 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.0.0.RC3 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.0.0.RC4 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.0.0.RC5 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.0.0.RC6 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.0.0.v20091005 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.0.1.v20091125 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.0.2.RC0 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.0.2.v20100331 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.1.0.RC0 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.1.0.RC1 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.1.0.v20100505 | No fix listed |
Show 175 more
| Product | Affected versions | Fixed in |
|---|---|---|
| org.eclipse.jetty/jetty-server(Maven) | = 7.1.1.v20100517 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.1.2.v20100523 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.1.3.v20100526 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.1.4.v20100610 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.1.5.v20100705 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.1.6.v20100715 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.2.0.RC0 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.2.0.v20101020 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.2.1.v20101111 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.2.2.v20101205 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.3.0.v20110203 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.3.1.v20110307 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.4.0.RC0 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.4.0.v20110414 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.4.1.v20110513 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.4.2.v20110526 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.4.3.v20110701 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.4.4.v20110707 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.4.5.v20110725 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.5.0.RC0 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.5.0.RC1 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.5.0.RC2 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.5.0.v20110901 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.5.1.v20110908 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.5.2.v20111006 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.5.3.v20111011 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.5.4.v20111024 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.6.0.RC0 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.6.0.RC1 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.6.0.RC2 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.6.0.RC3 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.6.0.RC4 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.6.0.RC5 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.6.0.v20120127 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.6.1.v20120215 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.6.10.v20130312 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.6.11.v20130520 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.6.12.v20130726 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.6.13.v20130916 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.6.14.v20131031 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.6.15.v20140411 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.6.16.v20140903 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.6.17.v20150415 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.6.18.v20150929 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.6.19.v20160209 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.6.2.v20120308 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.6.20.v20160902 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.6.21.v20160908 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.6.3.v20120416 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.6.4.v20120524 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.6.5.v20120716 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.6.6.v20120903 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.6.7.v20120910 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.6.8.v20121106 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.6.9.v20130131 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.0.0.M0 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.0.0.M1 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.0.0.M2 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.0.0.M3 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.0.0.RC0 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.0.0.v20110901 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.0.1.v20110908 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.0.2.v20111006 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.0.3.v20111011 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.0.4.v20111024 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.1.0.RC0 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.1.0.RC1 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.1.0.RC2 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.1.0.RC4 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.1.0.RC5 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.1.0.v20120127 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.1.1.v20120215 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.1.10.v20130312 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.1.11.v20130520 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.1.12.v20130726 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.1.13.v20130916 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.1.14.v20131031 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.1.15.v20140411 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.1.16.v20140903 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.1.17.v20150415 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.1.18.v20150929 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.1.19.v20160209 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.1.2.v20120308 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.1.20.v20160902 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.1.21.v20160908 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.1.22.v20160922 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.1.3.v20120416 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.1.4.v20120524 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.1.5.v20120716 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.1.6.v20120903 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.1.7.v20120910 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.1.8.v20121106 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.1.9.v20130131 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.2.0.v20160908 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.0.0.M0 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.0.0.M1 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.0.0.M2 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.0.0.M3 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.0.0.M4 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.0.0.M5 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.0.0.RC0 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.0.0.RC1 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.0.0.RC2 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.0.0.v20130308 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.0.1.v20130408 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.0.2.v20130417 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.0.3.v20130506 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.0.4.v20130625 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.0.5.v20130815 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.0.6.v20130930 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.0.7.v20131107 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.1.0.M0 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.1.0.RC0 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.1.0.RC1 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.1.0.RC2 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.1.0.v20131115 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.1.1.v20140108 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.1.2.v20140210 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.1.3.v20140225 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.1.4.v20140401 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.1.5.v20140505 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.1.6.v20160112 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.2.0.M0 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.2.0.M1 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.2.0.RC0 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.2.0.v20140526 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.2.1.v20140609 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.2.10.v20150310 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.2.11.M0 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.2.11.v20150529 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.2.12.M0 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.2.12.v20150709 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.2.13.v20150730 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.2.14.v20151106 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.2.15.v20160210 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.2.16.v20160414 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.2.17.v20160517 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.2.18.v20160721 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.2.19.v20160908 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.2.2.v20140723 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.2.20.v20161216 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.2.21.v20170120 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.2.22.v20170606 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.2.23.v20171218 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.2.24.v20180105 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.2.25.v20180606 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.2.26.v20180806 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.2.27.v20190403 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.2.28.v20190418 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.2.29.v20191105 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.2.3.v20140905 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.2.30.v20200428 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.2.4.v20141103 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.2.5.v20141112 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.2.6.v20141205 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.2.7.v20150116 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.2.8.v20150217 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.2.9.v20150224 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.3.0.M0 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.3.0.M1 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.3.0.M2 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.3.0.RC0 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.3.0.RC1 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.3.0.v20150612 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.3.1.v20150714 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.3.10.M0 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.3.10.v20160621 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.3.11.M0 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.3.11.v20160721 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.3.12.v20160915 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.3.13.M0 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.3.13.v20161014 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.3.14.v20161028 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.3.15.v20161220 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.3.16.v20170120 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- bugs.eclipse.org third-party-advisory
- github.com vendor-advisory
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- security.netapp.com
- support.hpe.com
- DSA-4278 third-party-advisory vendor-advisory
- www.oracle.com
- www.oracle.com
- 1041194 third-party-advisory vdb-entry
- Debian Security Tracker CVE-2017-7656 vendor-advisory
- bugs.debian.org issue-tracking
- [activemq-issues] 20190820 [jira] [Created] (AMQ-7279) Security Vulnerabilities in Libraries - jackson-databind-2.9.8.jar, tomcat-servlet-api-8.0.53.jar, tomcat-websocket-api-8.0.53.jar, zookeeper-3.4.6.jar, guava-18.0.jar, jetty-all-9.2.26.v20180806.jar, scala-library-2.11.0.jar mailing-list
- [lucene-solr-user] 20190104 Re: SOLR v7 Security Issues Caused Denial of Use - Sonatype Application Composition Report mailing-list
- [druid-commits] 20191115 [GitHub] [incubator-druid] ccaominh opened a new pull request #8878: Address security vulnerabilities mailing-list
- [maven-issues] 20200730 [GitHub] [maven-dependency-plugin] slachiewicz commented on pull request #91: Bump jettyVersion from 9.2.28.v20190418 to 9.3.0.v20150612 mailing-list
- www.oracle.com