Integer Overflow Vulnerability in Eclipse Jetty Web Server

CVE-2017-7657

What is CVE-2017-7657?

In Eclipse Jetty versions 9.2.x and older, all configurations of 9.3.x, and 9.4.x when RFC2616 compliance is enabled, an integer overflow occurs due to improper handling of transfer-encoding chunk lengths. This vulnerability allows attackers to send a large chunk size that could be interpreted as a smaller size, potentially crafting a fake pipelined request. If Jetty is deployed behind an intermediary with authorization, this flaw could be exploited to bypass such authorization, leading to unauthorized request processing.

References