CVE-2017-7658

About vulnerability

Eclipse Jetty Server versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), are vulnerable to HTTP Request Smuggling when presented with two content-lengths headers, allowing authorization bypass. When presented with a content-length and a chunked encoding header, the content-length was ignored (as per RFC 2616). If an intermediary decides on the shorter length, but still passes on the longer body, then body content could be interpreted by Jetty as a pipelined request. If the intermediary is imposing authorization, the fake pipelined request bypasses that authorization.

Affected product:

Apache CXF , Apache Hadoop , Apache Hive , Apache Kafka , Apache Lucene , Apache Solr , Apache Spark , Apache Tapestry , Eclipse Jetty , Elasticsearch , Spring , accumulo , activemq , agepredictor , airlift , alluxio , apache-el , apache-jsp , artemis , athenz , avro , aws-sdk-java-v2 , bookkeeper , camel , client_java , console , debezium , directory-server , discovery , druid , flink , flume , geode , geronimo-xbean , gwt , gwtp , hapi-fhir , hbase , hbase-thirdparty , htmlunit , ignite , incubator-retired-htrace , io.airlift:jmx-http , jasper-jsp , java-cas-client , jena , jersey , jgit , jsonpath , karaf , kite , logging-flume , logging-flume-irc , metrics , micrometer , micrometer-tracing , mustache.java , neo4j , neo4j-ogm , opencensus-java , pravega , pulsar , selenium , signalfx-java , storm , tika , tinkerpop , trino , wiremock , zookeeper

Affected packages:

apache-el @ 8.5.100 (+25001 more)