Vulnerability in Eclipse Jetty
CVE-2023-40167
Jetty is a Java based web server and servlet engine. Prior to versions 9.4.52, 10.0.16, 11.0.16, and 12.0.1, Jetty accepts the `+` character proceeding the content-length value in a HTTP/1 header field. This is more permissive than allowed by the RFC and other servers routinely reject such requests with 400 responses. There is no known exploit scenario, but it is conceivable that request smuggling could result if jetty is used in combination with a server that does not close the connection after sending such a 400 response. Versions 9.4.52, 10.0.16, 11.0.16, and 12.0.1 contain a patch for this issue. There is no workaround as there is no known exploit scenario.
EPSS: 0.011 (62.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N.
Affected products
- Eclipse Jetty — versions 12.0.0
- Eclipse Jetty.project — versions >= 9.0.0, <= 9.4.51, >= 10.0.0, <= 10.0.15, >= 11.0.0, <= 11.0.15
- Debian Debian_linux — versions 10.0, 11.0, 12.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)
- security-advisories@github.com (Technical Description, x_refsource_MISC)
- security-advisories@github.com (Third Party Advisory)
- security-advisories@github.com (Mailing List, Third Party Advisory)
Frequently asked questions
- What is CVE-2023-40167?
- CVE-2023-40167 is a medium-severity vulnerability in Eclipse Jetty, classified under Improper Handling of Length Parameter Inconsistency. CVSS score: 5.3/10. Published 2023-09-15.
- How severe is CVE-2023-40167?
- Medium severity. CVSS v3 base score is 5.3 out of 10.
- Is CVE-2023-40167 known to be exploited?
- 3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.