Improper Handling of HTTP/0.9 Requests in Eclipse Jetty
CVE-2017-7656

7.5HIGH

Key Information:

Vendor

The Eclipse Foundation

Status
Eclipse Jetty
Vendor
CVE Published:
26 June 2018

What is CVE-2017-7656?

In Eclipse Jetty, earlier versions exhibit a flaw in handling HTTP/0.9 requests. This flaw occurs when an HTTP/1 style request line, declaring HTTP/0.9, gets improperly accepted as a valid request. If the server is behind an intermediary that supports HTTP/0.9 but fails to process it effectively, the intermediary might misinterpret the response. This misinterpretation could lead to cache poisoning if the origin client is permitted to generate arbitrary content in these responses, highlighting a significant security concern for deployments that rely on caching mechanisms.

Affected Version(s)

Eclipse Jetty <= 9.2.0

Eclipse Jetty 9.3.0

Eclipse Jetty < 9.3.24

References

https://www.debian.org/security/2018/dsa-4278
vendor-advisoryx_refsource_DEBIAN
http://www.securitytracker.com/id/1041194
vdb-entryx_refsource_SECTRACK
https://lists.apache.org/thread.html/708d94141126eac03011...
mailing-listx_refsource_MLIST

EPSS Score

6% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.