NetSight
IP …
critical9.8

CVE-2017-7658

In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), when presented with two co…

Impact

In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), when presented with two content-lengths headers, Jetty ignored the second. When presented with a content-length and a chunked encoding header, the content-length was ignored (as per RFC 2616). If an intermediary decided on the shorter length, but still passed on the longer body, then body content could be interpreted by Jetty as a pipelined request. If the intermediary was imposing authorization, the fake pipelined request would bypass that authorization.

Affected products

VendorProductAffected versions
EclipseJetty
through 9.2.26
from 9.3.0 before 9.3.24
from 9.4.0 before 9.4.11
DebianDebian Linux
Version 9.0
OracleRest Data Services
Versions 11.2.0.4, 12.1.0.2, 12.2.0.1, 18c
OracleRetail Xstore Payment
Version 3.3
OracleRetail Xstore Point Of Service
Versions 7.1, 15.0, 16.0, 17.0
HpXp P9000 Command View
from 8.4.0-00 through 8.6.2-00
NetappE-Series Santricity Management
All versions
NetappE-Series Santricity Os Controller
from 11.0 through 11.50.1
NetappE-Series Santricity Web Services
All versions
NetappHci Management Node
All versions
NetappHci Storage Node
All versions
NetappOncommand System Manager
from 3.0 through 3.1.3

Weakness classification

CWE-444

References