CVE-2017-7656 Jetty vulnerable to cache poisoning due to inconsistent HTTP request handling (HTTP Request Smuggling)
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2017-7656?
CVE-2017-7656 is a high-severity vulnerability in Debian Debian Linux, published on 26 Jun 2018.
Official description
In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), HTTP/0.9 is handled poorly. An HTTP/1 style request line (i.e. method space URI space version) that declares a version of HTTP/0.9 was accepted and treated as a 0.9 request. If deployed behind an intermediary that also accepted and passed through the 0.9 version (but did not act on it), then the response sent could be interpreted by the intermediary as HTTP/1 headers. This could be used to poison the cache if the server allowed the origin client to generate arbitrary content in the response.
Weakness: CWE-444
Which versions are affected by CVE-2017-7656?
4 open source packages ship an affected version, including org.eclipse.jetty:jetty-server. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
org.eclipse.jetty:jetty-server Maven | All versions | 9.3.24.v20180605 |
org.eclipse.jetty:jetty-server Maven | All versions | 9.3.24.v20180605 |
org.eclipse.jetty:jetty-server Maven | From 9.4.0 | 9.4.11.v20180605 |
org.eclipse.jetty:jetty-server Maven | From 9.4.0 | 9.4.11.v20180605 |
Products include Debian Debian Linux, Eclipse Jetty.
How do I fix CVE-2017-7656?
Upgrade org.eclipse.jetty:jetty-server to a fixed version for your release line: 9.3.24.v20180605 or 9.4.11.v20180605.
Is CVE-2017-7656 being exploited?
There is no known exploitation of CVE-2017-7656 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as CLEANSTART-2026-YD52185, DEBIAN-CVE-2017-7656, GHSA-84q7-p226-4x5w, UBUNTU-CVE-2017-7656.