What’s Vulnerable › Vulnerabilities
CVE-2017-7658
- Severity: critical (CVSS 9.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 19.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2018-06-26 · updated 2026-06-17
- Weakness: CWE-444
Description
In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), when presented with two content-lengths headers, Jetty ignored the second. When presented with a content-length and a chunked encoding header, the content-length was ignored (as per RFC 2616). If an intermediary decided on the shorter length, but still passed on the longer body, then body content could be interpreted by Jetty as a pipelined request. If the intermediary was imposing authorization, the fake pipelined request would bypass that authorization.
Affected products
- Debian Linux: 9.0
- The Eclipse Foundation Eclipse Jetty: through 9.2.26; from 9.3.0 before 9.3.24; from 9.4.0 before 9.4.11 — fixed in 9.3.24, 9.4.11
- HP Xp P9000 Command View: from 8.4.0-00 through 8.6.2-00
- NetApp E-Series Santricity Management: all versions
- E-Series SANtricity OS Controller Software 11.x: from 11.0 through 11.50.1
- NetApp E-Series Santricity Web Services: all versions
- NetApp Hci Management Node: all versions
- NetApp Hci Storage Node: all versions
- OnCommand System Manager 9.x: from 3.0 through 3.1.3
- NetApp Oncommand Unified Manager For 7-Mode: all versions
- NetApp Santricity Cloud Connector: all versions
- NetApp Snap Creator Framework: all versions
- NetApp SnapCenter: all versions
- SnapManager for Oracle: all versions
- NetApp Solidfire: all versions
- NetApp Storage Services Connector: all versions
- Oracle Corporation Oracle REST Data Services: 11.2.0.4, 12.1.0.2, 12.2.0.1, 18c
- Oracle Corporation MICROS Xstore Payment: 3.3
- Oracle Corporation Retail Xstore Point of Service: 7.1, 15.0, 16.0, 17.0
How to fix
Upgrade to a fixed version: The Eclipse Foundation Eclipse Jetty 9.3.24, 9.4.11. Check the vendor advisory for mitigations.
References
- http://www.securityfocus.com/bid/106566
- http://www.securitytracker.com/id/1041194
- https://bugs.eclipse.org/bugs/show_bug.cgi?id=535669
- https://lists.apache.org/thread.html/053d9ce4d579b02203db18545fee5e33f35f2932885459b74d1e4272%40%3Cissues.activemq.apache.org%3E
- https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451%40%3Csolr-user.lucene.apache.org%3E
- https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe%40%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E
- https://lists.apache.org/thread.html/r41af10c4adec8d34a969abeb07fd0d6ad0c86768b751464f1cdd23e8%40%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/r9159c9e7ec9eac1613da2dbaddbc15691a13d4dbb2c8be974f42e6ae%40%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/ra6f956ed4ec2855583b2d0c8b4802b450f593d37b77509b48cd5d574%40%3Ccommits.druid.apache.org%3E
- https://security.netapp.com/advisory/ntap-20181014-0001/
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03953en_us
Get alerted when CVE-2017-7658 or the next vulnerability affects your stack