CVE-2017-7656

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2017-7656
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-7656.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2017-7656
Aliases
Downstream
Published
2018-06-26T15:29:00.217Z
Modified
2026-04-10T04:00:58.813834Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
Summary
[none]
Details

In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), HTTP/0.9 is handled poorly. An HTTP/1 style request line (i.e. method space URI space version) that declares a version of HTTP/0.9 was accepted and treated as a 0.9 request. If deployed behind an intermediary that also accepted and passed through the 0.9 version (but did not act on it), then the response sent could be interpreted by the intermediary as HTTP/1 headers. This could be used to poison the cache if the server allowed the origin client to generate arbitrary content in the response.

References

Affected packages

Git / github.com/eclipse/jetty.project

Affected ranges

Type
GIT
Repo
https://github.com/eclipse/jetty.project
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
8c637489ae2bdc2d281b8db171e7427a47fdcc2b
Introduced
390f3200cce7f90f1f3ebc78013c1afea2f93db8
Fixed
84205aa28f11a4f31f2a3b86d1bba2cc8ab69827
Introduced
bf9d17540c7ae4c91be30c045a9485aa2030d3e5
Fixed
d5fc0523cfa96bfebfbda19606cad384d772f04c
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
883fe0e8317a89c46b49465bac2dcd07166e714c
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.2.26"
        },
        {
            "introduced": "9.3.0"
        },
        {
            "fixed": "9.3.24"
        },
        {
            "introduced": "9.4.0"
        },
        {
            "fixed": "9.4.11"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0"
        }
    ]
}

Affected versions

jetty-8.*
jetty-8.0.0.RC0
jetty-8.1.0.RC0
jetty-9.*
jetty-9.0.x
jetty-9.1.0.M0
jetty-9.1.0.RC0
jetty-9.1.0.RC1
jetty-9.1.0.RC2
jetty-9.1.0.v20131115
jetty-9.1.1.v20140108
jetty-9.1.2.v20140210
jetty-9.1.3.v20140225
jetty-9.1.4.v20140401
jetty-9.2.0.M0
jetty-9.2.0.M1
jetty-9.2.0.RC0
jetty-9.2.0.v20140523
jetty-9.2.0.v20140526
jetty-9.2.1.v20140609
jetty-9.2.10.v20150310
jetty-9.2.11.M0
jetty-9.2.11.v20150528
jetty-9.2.11.v20150529
jetty-9.2.12.M0
jetty-9.2.12.v20150709
jetty-9.2.13.v20150730
jetty-9.2.15.v20160210
jetty-9.2.18.v20160721
jetty-9.2.19.v20160908
jetty-9.2.2.v20140723
jetty-9.2.20.v20161216
jetty-9.2.21.v20170120
jetty-9.2.22.v20170606
jetty-9.2.23.v20171218
jetty-9.2.26.v20180806
jetty-9.2.3.v20140905
jetty-9.2.4.v20141103
jetty-9.2.5.v20141112
jetty-9.2.6.v20141203
jetty-9.2.6.v20141205
jetty-9.2.7.v20150116
jetty-9.2.8.v20150217
jetty-9.2.9.v20150224
jetty-9.3.13.M0
jetty-9.3.17.v20170317
jetty-9.3.18.v20170406
jetty-9.3.19.v20170502
jetty-9.3.23.v20180228
jetty-9.3.4.v20151007
jetty-9.3.7.RC1
jetty-9.3.7.v20160115
jetty-9.4.10.v20180503
jetty-9.4.2.v20170220
jetty-9.4.6.v20170531

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-7656.json"