Bugzilla – Bug 1215417
VUL-0: CVE-2023-40167: jetty-minimal,jetty-websocket: accepts "+" prefixed value in Content-Length
Last modified: 2024-03-05 09:21:33 UTC
CVE-2023-40167 Jetty is a Java based web server and servlet engine. Prior to versions 9.4.52, 10.0.16, 11.0.16, and 12.0.1, Jetty accepts the `+` character proceeding the content-length value in a HTTP/1 header field. This is more permissive than allowed by the RFC and other servers routinely reject such requests with 400 responses. There is no known exploit scenario, but it is conceivable that request smuggling could result if jetty is used in combination with a server that does not close the connection after sending such a 400 response. Versions 9.4.52, 10.0.16, 11.0.16, and 12.0.1 contain a patch for this issue. There is no workaround as there is no known exploit scenario. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-40167 https://www.cve.org/CVERecord?id=CVE-2023-40167 https://github.com/eclipse/jetty.project/security/advisories/GHSA-hmr7-m48g-48f6 https://www.rfc-editor.org/rfc/rfc9110#section-8.6
SUSE-SU-2023:4210-1: An update that solves five vulnerabilities can now be installed. Category: security (important) Bug References: 1215415, 1215416, 1215417, 1216162, 1216169 CVE References: CVE-2023-36478, CVE-2023-36479, CVE-2023-40167, CVE-2023-41900, CVE-2023-44487 Sources used: SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (src): jetty-minimal-9.4.53-150200.3.22.1 SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (src): jetty-minimal-9.4.53-150200.3.22.1 SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (src): jetty-minimal-9.4.53-150200.3.22.1 SUSE Linux Enterprise Server for SAP Applications 15 SP2 (src): jetty-minimal-9.4.53-150200.3.22.1 SUSE Linux Enterprise Server for SAP Applications 15 SP3 (src): jetty-minimal-9.4.53-150200.3.22.1 SUSE Enterprise Storage 7.1 (src): jetty-minimal-9.4.53-150200.3.22.1 openSUSE Leap 15.4 (src): jetty-minimal-9.4.53-150200.3.22.1 openSUSE Leap 15.5 (src): jetty-minimal-9.4.53-150200.3.22.1 Development Tools Module 15-SP4 (src): jetty-minimal-9.4.53-150200.3.22.1 Development Tools Module 15-SP5 (src): jetty-minimal-9.4.53-150200.3.22.1 SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (src): jetty-minimal-9.4.53-150200.3.22.1 SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 (src): jetty-minimal-9.4.53-150200.3.22.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Fixed, please close.