GitHub Advisoryadvisory · Maven

GHSA-84q7-p226-4x5w Jetty vulnerable to cache poisoning due to inconsistent HTTP request handling (HTTP Request Smuggling)

HIGH Published 2018-10-19 Modified 2022-09-14 Official page ↗
Aliases
CVE-2017-7656
Ecosystem
Maven
Packages
org.eclipse.jetty:jetty-server
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-444
Reviewed
2020-06-16

Affected packages

• Maven org.eclipse.jetty:jetty-server: < 9.3.24.v20180605 → fixed in 9.3.24.v20180605 • Maven org.eclipse.jetty:jetty-server: >= 9.4.0, < 9.4.11.v20180605 → fixed in 9.4.11.v20180605

Description

Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), contain an HTTP Request Smuggling Vulnerability that can result in cache poisoning.

Related

Alias · CVE (1)

  • CVE-2017-7656 In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance… vulnerability

Weakness · CWE (1)

  • CWE-444 Inconsistent Interpretation of HTTP Requests weakness

References