Bug 1192155 (CVE-2017-7658)

Summary: VUL-0: CVE-2017-7658: jetty-minimal: Incorrect header handling
Product: [Novell Products] SUSE Security Incidents Reporter: Gabriele Sonnu <gabriele.sonnu>
Component: IncidentsAssignee: Security Team bot <security-team>
Status: RESOLVED INVALID QA Contact: Security Team bot <security-team>
Severity: Normal    
Priority: P5 - None CC: smash_bz
Version: unspecified   
Target Milestone: ---   
Hardware: Other   
OS: Other   
URL: https://smash.suse.de/issue/208919/
Whiteboard:
Found By: Security Response Team Services Priority:
Business Priority: Blocker: ---
Marketing QA Status: --- IT Deployment: ---

Description Gabriele Sonnu 2021-10-29 09:48:39 UTC 
In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), when presented with two content-lengths headers, Jetty ignored the second. When presented with a content-length and a chunked encoding header, the content-length was ignored (as per RFC 2616). If an intermediary decided on the shorter length, but still passed on the longer body, then body content could be interpreted by Jetty as a pipelined request. If the intermediary was imposing authorization, the fake pipelined request would bypass that authorization.

Upstream issue:

https://bugs.eclipse.org/bugs/show_bug.cgi?id=535669

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1595621
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-7658
https://www.oracle.com/security-alerts/cpuoct2020.html#CVE-2017-7658
https://www.oracle.com/security-alerts/cpujan2019.html#CVE-2017-7658
http://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html#CVE-2017-7658
https://www.oracle.com/security-alerts/cpuoct2020.html
https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
https://access.redhat.com/security/cve/CVE-2017-7658
http://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-7658.html
https://access.redhat.com/errata/RHSA-2020:3779
http://www.debian.org/security/-1/dsa-4278
https://access.redhat.com/errata/RHSA-2020:3779.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7658
https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe@%3Ccommits.druid.apache.org%3E
http://www.securityfocus.com/bid/106566
https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451@%3Csolr-user.lucene.apache.org%3E
https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0@%3Cissues.bookkeeper.apache.org%3E
https://lists.apache.org/thread.html/r41af10c4adec8d34a969abeb07fd0d6ad0c86768b751464f1cdd23e8@%3Ccommits.druid.apache.org%3E
http://www.securitytracker.com/id/1041194
https://lists.apache.org/thread.html/r9159c9e7ec9eac1613da2dbaddbc15691a13d4dbb2c8be974f42e6ae@%3Ccommits.druid.apache.org%3E
https://bugs.eclipse.org/bugs/show_bug.cgi?id=535669
https://lists.apache.org/thread.html/ra6f956ed4ec2855583b2d0c8b4802b450f593d37b77509b48cd5d574@%3Ccommits.druid.apache.org%3E
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03953en_us
https://lists.apache.org/thread.html/053d9ce4d579b02203db18545fee5e33f35f2932885459b74d1e4272@%3Cissues.activemq.apache.org%3E
https://www.debian.org/security/2018/dsa-4278
https://security.netapp.com/advisory/ntap-20181014-0001/
Comment 1 Gabriele Sonnu 2021-10-29 09:49:33 UTC 
Not affecting us. Closing as INVALID.