CVE-2017-7658 vulnerability in Eclipse and Other Products
Published on June 26, 2018

In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), when presented with two content-lengths headers, Jetty ignored the second. When presented with a content-length and a chunked encoding header, the content-length was ignored (as per RFC 2616). If an intermediary decided on the shorter length, but still passed on the longer body, then body content could be interpreted by Jetty as a pipelined request. If the intermediary was imposing authorization, the fake pipelined request would bypass that authorization.

Vendor Advisory NVD

Weakness Type

What is a HTTP Request Smuggling Vulnerability?

When malformed or abnormal HTTP requests are interpreted by one or more entities in the data flow between the user and the web server, such as a proxy or firewall, they can be interpreted inconsistently, allowing the attacker to "smuggle" a request to one device without the other device being aware of it.

CVE-2017-7658 has been classified to as a HTTP Request Smuggling vulnerability or weakness.

Products Associated with CVE-2017-7658

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2017-7658 are published in these products:

Eclipse Jetty

NetApp E Series Santricity Management

NetApp E Series Santricity Os Controller

NetApp E Series Santricity Web Services

NetApp Hci Management Node

NetApp Oncommand System Manager

NetApp Santricity Cloud Connector

NetApp Snapcenter

NetApp Snapmanager

NetApp Snap Creator Framework

NetApp Solidfire

Oracle Rest Data Services

Oracle Retail Xstore Payment

Oracle Retail Xstore Point Of Service

Debian Linux

NetApp Hci Storage Node

NetApp Oncommand Unified Manager 7 Mode

NetApp Storage Services Connector

Affected Versions

The Eclipse Foundation Eclipse Jetty:

Version unspecified and below 9.2.25 is affected.
Version 9.3.0 and below unspecified is affected.
Version unspecified and below 9.3.24 is affected.
Version 9.4.0 and below unspecified is affected.
Version unspecified and below 9.4.11 is affected.

Exploit Probability

EPSS

8.69%

Percentile

92.31%