Vulnerability in Eclipse Jetty
CVE-2017-7658
In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), when presented with two content-lengths headers, Jetty ignored the second. When presented with a content-length and a chunked encoding header, the content-length was ignored (as per RFC 2616). If an intermediary decided on the shorter length, but still passed on the longer body, then body content could be interpreted by Jetty as a pipelined request. If the intermediary was imposing authorization, the fake pipelined request would bypass that authorization.
Vulnerability class: HTTP Request Smuggling
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.194 (97.4th percentile), scored .
Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 97th percentile — 97.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.194 · newest: 0.194 · change: 0.000
Affected products
Weakness classification (CWE)
Public proof-of-concept exploits
References
- www.debian.org/security/2018/dsa-4278 (vendor-advisory, Third Party Advisory)
- www.securitytracker.com/id/1041194 (VDB Entry, Third Party Advisory, vdb-entry)
- www.securityfocus.com/bid/106566 (VDB Entry, Third Party Advisory, vdb-entry)
- lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535… (mailing-list)
- lists.apache.org/thread.html/053d9ce4d579b02203db18545fee5e33f35f2932885459b74d… (mailing-list)
- lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd55… (mailing-list)
- www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html (Patch, Third Party Advisory)
- www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html (Patch, Third Party Advisory)
- lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e6… (mailing-list)
- www.oracle.com/security-alerts/cpuoct2020.html (Third Party Advisory)
Frequently asked questions
- What is CVE-2017-7658?
- CVE-2017-7658 is a critical-severity vulnerability in Eclipse Jetty, classified under Inconsistent Interpretation of HTTP Requests (HTTP Request/Response Smuggling). CVSS score: 9.8/10. Published 2018-06-26.
- How severe is CVE-2017-7658?
- Critical severity. CVSS v3 base score is 9.8 out of 10.
- Is CVE-2017-7658 known to be exploited?
- 5 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.