CVE-2017-7658 Jetty vulnerable to authorization bypass due to inconsistent HTTP request handling (HTTP Request Smuggling)
CriticalCVSS 9.8
EPSS 19.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), when presented with two content-lengths headers, Jetty ignored the second. When presented with a content-length and a chunked encoding header, the content-length was ignored (as per RFC 2616). If an intermediary decided on the shorter length, but still passed on the longer body, then body content could be interpreted by Jetty as a pipelined request. If the intermediary was imposing authorization, the fake pipelined request would bypass that authorization.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.eclipse.jetty/jetty-server(Maven) | < 9.2.25.v20180606 | 9.2.25.v20180606 |
| org.eclipse.jetty/jetty-server(Maven) | >= 9.3.0, < 9.3.24.v20180605 | 9.3.24.v20180605 |
| org.eclipse.jetty/jetty-server(Maven) | >= 9.4.0, < 9.4.11.v20180605 | 9.4.11.v20180605 |
| org.eclipse.jetty/jetty-server(Maven) | = 7.0.0.M0 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.0.0.M1 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.0.0.M2 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.0.0.M3 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.0.0.M4 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.0.0.RC0 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.0.0.RC1 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.0.0.RC2 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.0.0.RC3 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.0.0.RC4 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.0.0.RC5 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.0.0.RC6 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.0.0.v20091005 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.0.1.v20091125 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.0.2.RC0 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.0.2.v20100331 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.1.0.RC0 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.1.0.RC1 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.1.0.v20100505 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.1.1.v20100517 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.1.2.v20100523 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.1.3.v20100526 | No fix listed |
Show 175 more
| Product | Affected versions | Fixed in |
|---|---|---|
| org.eclipse.jetty/jetty-server(Maven) | = 7.1.4.v20100610 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.1.5.v20100705 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.1.6.v20100715 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.2.0.RC0 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.2.0.v20101020 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.2.1.v20101111 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.2.2.v20101205 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.3.0.v20110203 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.3.1.v20110307 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.4.0.RC0 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.4.0.v20110414 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.4.1.v20110513 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.4.2.v20110526 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.4.3.v20110701 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.4.4.v20110707 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.4.5.v20110725 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.5.0.RC0 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.5.0.RC1 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.5.0.RC2 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.5.0.v20110901 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.5.1.v20110908 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.5.2.v20111006 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.5.3.v20111011 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.5.4.v20111024 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.6.0.RC0 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.6.0.RC1 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.6.0.RC2 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.6.0.RC3 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.6.0.RC4 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.6.0.RC5 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.6.0.v20120127 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.6.1.v20120215 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.6.10.v20130312 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.6.11.v20130520 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.6.12.v20130726 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.6.13.v20130916 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.6.14.v20131031 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.6.15.v20140411 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.6.16.v20140903 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.6.17.v20150415 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.6.18.v20150929 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.6.19.v20160209 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.6.2.v20120308 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.6.20.v20160902 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.6.21.v20160908 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.6.3.v20120416 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.6.4.v20120524 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.6.5.v20120716 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.6.6.v20120903 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.6.7.v20120910 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.6.8.v20121106 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 7.6.9.v20130131 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.0.0.M0 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.0.0.M1 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.0.0.M2 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.0.0.M3 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.0.0.RC0 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.0.0.v20110901 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.0.1.v20110908 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.0.2.v20111006 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.0.3.v20111011 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.0.4.v20111024 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.1.0.RC0 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.1.0.RC1 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.1.0.RC2 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.1.0.RC4 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.1.0.RC5 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.1.0.v20120127 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.1.1.v20120215 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.1.10.v20130312 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.1.11.v20130520 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.1.12.v20130726 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.1.13.v20130916 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.1.14.v20131031 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.1.15.v20140411 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.1.16.v20140903 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.1.17.v20150415 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.1.18.v20150929 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.1.19.v20160209 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.1.2.v20120308 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.1.20.v20160902 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.1.21.v20160908 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.1.22.v20160922 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.1.3.v20120416 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.1.4.v20120524 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.1.5.v20120716 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.1.6.v20120903 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.1.7.v20120910 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.1.8.v20121106 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.1.9.v20130131 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 8.2.0.v20160908 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.0.0.M0 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.0.0.M1 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.0.0.M2 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.0.0.M3 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.0.0.M4 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.0.0.M5 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.0.0.RC0 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.0.0.RC1 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.0.0.RC2 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.0.0.v20130308 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.0.1.v20130408 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.0.2.v20130417 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.0.3.v20130506 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.0.4.v20130625 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.0.5.v20130815 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.0.6.v20130930 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.0.7.v20131107 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.1.0.M0 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.1.0.RC0 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.1.0.RC1 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.1.0.RC2 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.1.0.v20131115 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.1.1.v20140108 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.1.2.v20140210 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.1.3.v20140225 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.1.4.v20140401 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.1.5.v20140505 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.1.6.v20160112 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.2.0.M0 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.2.0.M1 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.2.0.RC0 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.2.0.v20140526 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.2.1.v20140609 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.2.10.v20150310 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.2.11.M0 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.2.11.v20150529 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.2.12.M0 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.2.12.v20150709 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.2.13.v20150730 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.2.14.v20151106 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.2.15.v20160210 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.2.16.v20160414 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.2.17.v20160517 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.2.18.v20160721 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.2.19.v20160908 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.2.2.v20140723 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.2.20.v20161216 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.2.21.v20170120 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.2.22.v20170606 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.2.23.v20171218 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.2.24.v20180105 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.2.3.v20140905 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.2.4.v20141103 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.2.5.v20141112 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.2.6.v20141205 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.2.7.v20150116 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.2.8.v20150217 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.2.9.v20150224 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.3.0.v20150612 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.3.1.v20150714 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.3.10.M0 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.3.10.v20160621 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.3.11.M0 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.3.11.v20160721 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.3.12.v20160915 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.3.13.M0 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.3.13.v20161014 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.3.14.v20161028 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.3.15.v20161220 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.3.16.v20170120 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.3.17.RC0 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.3.17.v20170317 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.3.18.v20170406 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.3.19.v20170502 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.3.2.v20150730 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.3.20.v20170531 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.3.21.M0 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.3.21.RC0 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.3.21.v20170918 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.3.22.v20171030 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.3.23.v20180228 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.3.3.v20150827 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.3.4.RC0 | No fix listed |
| org.eclipse.jetty/jetty-server(Maven) | = 9.3.4.RC1 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- bugs.eclipse.org third-party-advisory
- github.com vendor-advisory
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- security.netapp.com third-party-advisory
- support.hpe.com third-party-advisory
- DSA-4278 third-party-advisory vendor-advisory
- www.oracle.com third-party-advisory
- www.oracle.com patch third-party-advisory
- www.oracle.com patch third-party-advisory
- 106566 third-party-advisory vdb-entry
- 1041194 third-party-advisory vdb-entry
- Debian Security Tracker CVE-2017-7658 vendor-advisory
- [activemq-issues] 20190820 [jira] [Created] (AMQ-7279) Security Vulnerabilities in Libraries - jackson-databind-2.9.8.jar, tomcat-servlet-api-8.0.53.jar, tomcat-websocket-api-8.0.53.jar, zookeeper-3.4.6.jar, guava-18.0.jar, jetty-all-9.2.26.v20180806.jar, scala-library-2.11.0.jar mailing-list
- [lucene-solr-user] 20190104 Re: SOLR v7 Security Issues Caused Denial of Use - Sonatype Application Composition Report mailing-list
- [druid-commits] 20191115 [GitHub] [incubator-druid] ccaominh opened a new pull request #8878: Address security vulnerabilities mailing-list
- [bookkeeper-issues] 20200729 [GitHub] [bookkeeper] padma81 opened a new issue #2387: Security vulnerabilities in the apache/bookkeeper-4.9.2 image mailing-list
- [druid-commits] 20210304 [GitHub] [druid] suneet-s commented on issue #10926: Hello, are there any plans to fix the CVE-2017-7657 and CVE-2017-7658 vulnerabilities of Jetty mailing-list
- [druid-commits] 20210304 [GitHub] [druid] suneet-s closed issue #10926: Hello, are there any plans to fix the CVE-2017-7657 and CVE-2017-7658 vulnerabilities of Jetty mailing-list
- [druid-commits] 20210226 [GitHub] [druid] kingnj opened a new issue #10926: Hello, are there any plans to fix the CVE-2017-7657 and CVE-2017-7658 vulnerabilities of Jetty mailing-list
- www.oracle.com
- bugs.debian.org issue-tracking