Improper Handling of HTTP/0.9 Requests in Eclipse Jetty

CVE-2017-7656

What is CVE-2017-7656?

In Eclipse Jetty, earlier versions exhibit a flaw in handling HTTP/0.9 requests. This flaw occurs when an HTTP/1 style request line, declaring HTTP/0.9, gets improperly accepted as a valid request. If the server is behind an intermediary that supports HTTP/0.9 but fails to process it effectively, the intermediary might misinterpret the response. This misinterpretation could lead to cache poisoning if the origin client is permitted to generate arbitrary content in these responses, highlighting a significant security concern for deployments that rely on caching mechanisms.

References