What’s Vulnerable › Vulnerabilities
CVE-2017-7657
- Severity: critical (CVSS 9.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 14.9% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2018-06-26 · updated 2026-06-17
- Weakness: CWE-444
Description
In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), transfer-encoding chunks are handled poorly. The chunk length parsing was vulnerable to an integer overflow. Thus a large chunk size could be interpreted as a smaller chunk size and content sent as chunk body could be interpreted as a pipelined request. If Jetty was deployed behind an intermediary that imposed some authorization and that intermediary allowed arbitrarily large chunks to be passed on unchanged, then this flaw could be used to bypass the authorization imposed by the intermediary as the fake pipelined request would not be interpreted by the intermediary as a request.
Affected products
- Debian Linux: 9.0
- The Eclipse Foundation Eclipse Jetty: through 9.2.26; from 9.3.0 before 9.3.24; from 9.4.0 before 9.4.11 — fixed in 9.3.24, 9.4.11
- HP Xp P9000 Command View: from 8.4.0-00 before 8.6.2-00 — fixed in 8.6.2-00
- NetApp E-Series Santricity Management: all versions
- E-Series SANtricity OS Controller Software 11.x: from 11.0 through 11.50.1
- NetApp E-Series Santricity Web Services: all versions
- NetApp Element Software: all versions
- NetApp Element Software Management Node: all versions
- NetApp Hci Storage Nodes: all versions
- OnCommand System Manager 9.x: 3.x
- NetApp OnCommand Unified Manager for 7-Mode (core package): before 5.2.4 — fixed in 5.2.4
- NetApp Santricity Cloud Connector: all versions
- NetApp Snap Creator Framework: before 4.3.3 — fixed in 4.3.3
- NetApp SnapCenter: before 4.1p3 — fixed in 4.1p3
- SnapManager for Oracle: before 3.4.2 — fixed in 3.4.2
- Oracle Corporation Oracle REST Data Services: 11.2.0.4, 12.1.0.2, 12.2.0.1, 18c
- Oracle Corporation Retail Xstore Point of Service: 7.1, 15.0, 16.0, 17.0
How to fix
Upgrade to a fixed version: The Eclipse Foundation Eclipse Jetty 9.3.24, 9.4.11; HP Xp P9000 Command View 8.6.2-00; NetApp OnCommand Unified Manager for 7-Mode (core package) 5.2.4; NetApp Snap Creator Framework 4.3.3; NetApp SnapCenter 4.1p3; SnapManager for Oracle 3.4.2. Check the vendor advisory for mitigations.
References
- http://www.securitytracker.com/id/1041194
- https://access.redhat.com/errata/RHSA-2019:0910
- https://bugs.eclipse.org/bugs/show_bug.cgi?id=535668
- https://lists.apache.org/thread.html/053d9ce4d579b02203db18545fee5e33f35f2932885459b74d1e4272%40%3Cissues.activemq.apache.org%3E
- https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451%40%3Csolr-user.lucene.apache.org%3E
- https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe%40%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E
- https://lists.apache.org/thread.html/r41af10c4adec8d34a969abeb07fd0d6ad0c86768b751464f1cdd23e8%40%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/r9159c9e7ec9eac1613da2dbaddbc15691a13d4dbb2c8be974f42e6ae%40%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/ra6f956ed4ec2855583b2d0c8b4802b450f593d37b77509b48cd5d574%40%3Ccommits.druid.apache.org%3E
- https://security.netapp.com/advisory/ntap-20181014-0001/
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03953en_us
Get alerted when CVE-2017-7657 or the next vulnerability affects your stack