Vulnerability in Eclipse Jetty Server Allows Authorization Bypass

CVE-2017-7658

What is CVE-2017-7658?

A vulnerability in the Eclipse Jetty Server allows the server to ignore the second content-length header when processing requests. When there is a conflict between a content-length header and chunked encoding, Jetty compromises by disregarding the content-length. This could lead to a scenario where intermediary systems, which may impose authorization, inadvertently allow unauthorized requests to bypass checks by treating extended requests as valid pipelined requests. The affected versions include Jetty Server 9.2.x and older, all non HTTP/1.x configurations of 9.3.x, and all HTTP/1.x configurations of 9.4.x, presenting a significant risk for users relying on Jetty for their web applications.

References