PT-2018-3790 · Eclipse+2 · Eclipse Jetty+2

Published 2018-06-26 · Updated 2021-09-23 · CVE-2017-7656

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Eclipse Jetty versions 9.2.x and older Eclipse Jetty versions 9.3.x Eclipse Jetty versions 9.4.x (non-default configuration with RFC2616 compliance enabled)

Description The issue arises from poor handling of HTTP/0.9 requests in Eclipse Jetty. An attacker could exploit this by sending specially crafted HTTP/0.9 requests, potentially leading to cache poisoning if the server allows the origin client to generate arbitrary content in the response. This could impact the confidentiality and integrity of protected information.

Recommendations For Eclipse Jetty versions 9.2.x and older, consider disabling HTTP/0.9 support until a patch is available. For Eclipse Jetty versions 9.3.x, restrict access to the server to minimize the risk of exploitation. For Eclipse Jetty versions 9.4.x with non-default configuration and RFC2616 compliance enabled, avoid using the non-default configuration until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

HTTP Request/Response Smuggling

Weakness Enumeration

CWE-444

Related Identifiers

ALT-PU-2019-2113

ALT-PU-2021-2857

BDU:2022-02668

CVE-2017-7656

DSA-4278-1

GHSA-84Q7-P226-4X5W

Affected Products

Alt Linux

Eclipse Jetty

Jira

References · 44

• https://cve.org/CVERecord?id=CVE-2017-7656 · Security Note
• https://osv.dev/vulnerability/DSA-4278-1 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2021-2857 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-7656 · Security Note
• https://bdu.fstec.ru/vul/2021-04177 · Security Note
• https://ubuntu.com/security/CVE-2017-7656 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-04281 · Security Note
• https://bdu.fstec.ru/vul/2022-02668 · Security Note
• https://debian.org/security/2018/dsa-4278 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7658 · Security Note
• https://security-tracker.debian.org/tracker/source-package/jetty9 · Vendor Advisory
• https://security-tracker.debian.org/tracker/DSA-4278-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7656 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7657 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-7656 · Vendor Advisory