CVE-2017-7658

In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), when presented with two content-lengths headers, Jetty ignored the second. When presented with a content-length and a chunked encoding header, the content-length was ignored (as per RFC 2616). If an intermediary decided on the shorter length, but still passed on the longer body, then body content could be interpreted by Jetty as a pipelined request. If the intermediary was imposing authorization, the fake pipelined request would bypass that authorization.

References

Affected packages

Git / github.com/eclipse/jetty.project

Affected ranges

Type

GIT

Repo

https://github.com/eclipse/jetty.project

Events

Introduced

Last affected

8c637489ae2bdc2d281b8db171e7427a47fdcc2b

Introduced

390f3200cce7f90f1f3ebc78013c1afea2f93db8

Fixed

84205aa28f11a4f31f2a3b86d1bba2cc8ab69827

Introduced

bf9d17540c7ae4c91be30c045a9485aa2030d3e5

Fixed

d5fc0523cfa96bfebfbda19606cad384d772f04c

Introduced

Last affected

883fe0e8317a89c46b49465bac2dcd07166e714c

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.2.26"
        },
        {
            "introduced": "9.3.0"
        },
        {
            "fixed": "9.3.24"
        },
        {
            "introduced": "9.4.0"
        },
        {
            "fixed": "9.4.11"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0"
        }
    ]
}

Affected versions

jetty-8.*

jetty-8.0.0.RC0

jetty-8.1.0.RC0

jetty-9.*

jetty-9.0.x

jetty-9.1.0.M0

jetty-9.1.0.RC0

jetty-9.1.0.RC1

jetty-9.1.0.RC2

jetty-9.1.0.v20131115

jetty-9.1.1.v20140108

jetty-9.1.2.v20140210

jetty-9.1.3.v20140225

jetty-9.1.4.v20140401

jetty-9.2.0.M0

jetty-9.2.0.M1

jetty-9.2.0.RC0

jetty-9.2.0.v20140523

jetty-9.2.0.v20140526

jetty-9.2.1.v20140609

jetty-9.2.10.v20150310

jetty-9.2.11.M0

jetty-9.2.11.v20150528

jetty-9.2.11.v20150529

jetty-9.2.12.M0

jetty-9.2.12.v20150709

jetty-9.2.13.v20150730

jetty-9.2.15.v20160210

jetty-9.2.18.v20160721

jetty-9.2.19.v20160908

jetty-9.2.2.v20140723

jetty-9.2.20.v20161216

jetty-9.2.21.v20170120

jetty-9.2.22.v20170606

jetty-9.2.23.v20171218

jetty-9.2.26.v20180806

jetty-9.2.3.v20140905

jetty-9.2.4.v20141103

jetty-9.2.5.v20141112

jetty-9.2.6.v20141203

jetty-9.2.6.v20141205

jetty-9.2.7.v20150116

jetty-9.2.8.v20150217

jetty-9.2.9.v20150224

jetty-9.3.13.M0

jetty-9.3.17.v20170317

jetty-9.3.18.v20170406

jetty-9.3.19.v20170502

jetty-9.3.23.v20180228

jetty-9.3.4.v20151007

jetty-9.3.7.RC1

jetty-9.3.7.v20160115

jetty-9.4.10.v20180503

jetty-9.4.2.v20170220

jetty-9.4.6.v20170531

Database specific

unresolved_ranges

[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "11.2.0.4"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "12.1.0.2"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "12.2.0.1"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "18c"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "3.3"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "7.1"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "15.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "16.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "17.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "8.4.0-00"
            },
            {
                "last_affected": "8.6.2-00"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "11.0"
            },
            {
                "last_affected": "11.50.1"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "3.0"
            },
            {
                "last_affected": "3.1.3"
            }
        ]
    }
]

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-7658.json"