Candidate: CVE-2017-7657
PublicDate: 2018-06-26 16:29:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7657
 https://bugs.eclipse.org/bugs/show_bug.cgi?id=535668
Description:
 In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and
 9.4.x (non-default configuration with RFC2616 compliance enabled),
 transfer-encoding chunks are handled poorly. The chunk length parsing was
 vulnerable to an integer overflow. Thus a large chunk size could be
 interpreted as a smaller chunk size and content sent as chunk body could be
 interpreted as a pipelined request. If Jetty was deployed behind an
 intermediary that imposed some authorization and that intermediary allowed
 arbitrarily large chunks to be passed on unchanged, then this flaw could be
 used to bypass the authorization imposed by the intermediary as the fake
 pipelined request would not be interpreted by the intermediary as a
 request.
Ubuntu-Description:
Notes:
 ebarretto> jetty8 ignored (very hard to exploit, complex patch)
Bugs:
Priority: low
Discovered-by:
Assigned-to:
CVSS:
 nvd: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H [9.8 CRITICAL]
 nvd: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H [9.8 CRITICAL]


Patches_jetty8:
upstream_jetty8: needed
precise/esm_jetty8: DNE
trusty_jetty8: ignored (out of standard support)
trusty/esm_jetty8: ignored
xenial_jetty8: ignored
artful_jetty8: DNE
bionic_jetty8: DNE
cosmic_jetty8: DNE
disco_jetty8: DNE
eoan_jetty8: DNE
focal_jetty8: DNE
groovy_jetty8: DNE
hirsute_jetty8: DNE
impish_jetty8: DNE
jammy_jetty8: DNE
devel_jetty8: DNE

Patches_jetty9:
upstream_jetty9: released (9.2.25-1, 9.2.21-1+deb9u1)
precise/esm_jetty9: DNE
trusty_jetty9: DNE
trusty/esm_jetty9: DNE
xenial_jetty9: ignored (end of standard support, was needed)
artful_jetty9: ignored (reached end-of-life)
bionic_jetty9: needed
cosmic_jetty9: not-affected (9.2.26-1)
disco_jetty9: not-affected (9.2.26-1)
eoan_jetty9: not-affected (9.2.26-1)
focal_jetty9: not-affected (9.2.26-1)
groovy_jetty9: not-affected (9.2.26-1)
hirsute_jetty9: not-affected (9.2.26-1)
impish_jetty9: not-affected (9.2.26-1)
jammy_jetty9: not-affected (9.2.26-1)
devel_jetty9: not-affected (9.2.26-1)