Candidate: CVE-2017-7658
PublicDate: 2018-06-26 17:29:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7658
 https://bugs.eclipse.org/bugs/show_bug.cgi?id=535669
Description:
 In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x
 configurations), and 9.4.x (all HTTP/1.x configurations), when presented
 with two content-lengths headers, Jetty ignored the second. When presented
 with a content-length and a chunked encoding header, the content-length was
 ignored (as per RFC 2616). If an intermediary decided on the shorter
 length, but still passed on the longer body, then body content could be
 interpreted by Jetty as a pipelined request. If the intermediary was
 imposing authorization, the fake pipelined request would bypass that
 authorization.
Ubuntu-Description:
Notes:
 ebarretto> jetty8 ignored (very hard to exploit, complex patch)
Bugs:
Priority: low
Discovered-by:
Assigned-to:
CVSS:
 nvd: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H [9.8 CRITICAL]
 nvd: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H [9.8 CRITICAL]


Patches_jetty8:
upstream_jetty8: needed
precise/esm_jetty8: DNE
trusty_jetty8: ignored (out of standard support)
trusty/esm_jetty8: ignored
xenial_jetty8: ignored
artful_jetty8: DNE
bionic_jetty8: DNE
cosmic_jetty8: DNE
disco_jetty8: DNE
eoan_jetty8: DNE
focal_jetty8: DNE
groovy_jetty8: DNE
hirsute_jetty8: DNE
impish_jetty8: DNE
jammy_jetty8: DNE
devel_jetty8: DNE

Patches_jetty9:
upstream_jetty9: released (9.2.25-1, 9.2.21-1+deb9u1)
precise/esm_jetty9: DNE
trusty_jetty9: DNE
trusty/esm_jetty9: DNE
xenial_jetty9: ignored (end of standard support, was needed)
artful_jetty9: ignored (reached end-of-life)
bionic_jetty9: needed
cosmic_jetty9: not-affected (9.2.26-1)
disco_jetty9: not-affected (9.2.26-1)
eoan_jetty9: not-affected (9.2.26-1)
focal_jetty9: not-affected (9.2.26-1)
groovy_jetty9: not-affected (9.2.26-1)
hirsute_jetty9: not-affected (9.2.26-1)
impish_jetty9: not-affected (9.2.26-1)
jammy_jetty9: not-affected (9.2.26-1)
devel_jetty9: not-affected (9.2.26-1)