PT-2018-3748 · Eclipse+1 · Eclipse Jetty+1

Published 2018-06-26 · Updated 2021-09-23 · CVE-2017-7657

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Eclipse Jetty versions 9.2.x and older Eclipse Jetty versions 9.3.x Eclipse Jetty versions 9.4.x (non-default configuration with RFC2616 compliance enabled)

Description The issue is related to the inconsistent interpretation of HTTP requests in the Eclipse Jetty servlet container. This can be exploited by a remote attacker to impact the confidentiality, integrity, and availability of protected information. The problem lies in the handling of transfer-encoding chunks, which are vulnerable to integer overflow. As a result, a large chunk size can be interpreted as a smaller chunk size, and content sent as a chunk body can be interpreted as a pipelined request. If Eclipse Jetty is deployed behind an intermediary that imposes authorization and allows large chunks to pass through unchanged, this flaw can be used to bypass the authorization imposed by the intermediary.

Recommendations For Eclipse Jetty versions 9.2.x and older, consider disabling the transfer-encoding chunk handling until a patch is available. For Eclipse Jetty versions 9.3.x, restrict access to the intermediary that imposes authorization to minimize the risk of exploitation. For Eclipse Jetty versions 9.4.x with non-default configuration and RFC2616 compliance enabled, avoid using large chunk sizes in transfer-encoding until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Integer Overflow

HTTP Request/Response Smuggling

Weakness Enumeration

CWE-190

CWE-444

Related Identifiers

ALT-PU-2019-2113

ALT-PU-2021-2857

BDU:2021-04177

CVE-2017-7657

DSA-4278-1

GHSA-VGG8-72F2-QM23

Affected Products

Alt Linux

Eclipse Jetty

References · 52

• https://osv.dev/vulnerability/DSA-4278-1 · Vendor Advisory
• https://security.netapp.com/advisory/ntap-20181014-0001 · Patch
• https://security-tracker.debian.org/tracker/CVE-2017-7657 · Vendor Advisory
• https://oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html · Patch
• https://bdu.fstec.ru/vul/2022-02668 · Security Note
• https://debian.org/security/2018/dsa-4278 · Vendor Advisory
• https://security-tracker.debian.org/tracker/source-package/jetty9 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2019:0910 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vgg8-72f2-qm23 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7657 · Security Note
• https://osv.dev/vulnerability/CVE-2017-7657 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2019-2113 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-7657 · Security Note
• https://cve.org/CVERecord?id=CVE-2017-7657 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12536 · Security Note