[MAVEN:GHSA-6X9X-8QW9-9PP6] Jetty vulnerable to authorization bypass due to inconsistent HTTP request handling (HTTP Request Smuggling)
Severity
Critical
Affected Packages
3
Fixed Packages
3
CVEs
1
Eclipse Jetty Server versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), are vulnerable to HTTP Request Smuggling when presented with two content-lengths headers, allowing authorization bypass. When presented with a content-length and a chunked encoding header, the content-length was ignored (as per RFC 2616). If an intermediary decides on the shorter length, but still passes on the longer body, then body content could be interpreted by Jetty as a pipelined request. If the intermediary is imposing authorization, the fake pipelined request bypasses that authorization.
Package | Affected Version |
---|---|
pkg:maven/org.eclipse.jetty/jetty-server | >= 9.4.0, < 9.4.11.v20180605 |
pkg:maven/org.eclipse.jetty/jetty-server | >= 9.3.0, < 9.3.24.v20180605 |
pkg:maven/org.eclipse.jetty/jetty-server | < 9.2.25.v20180606 |
Package | Fixed Version |
---|---|
pkg:maven/org.eclipse.jetty/jetty-server | = 9.4.11.v20180605 |
pkg:maven/org.eclipse.jetty/jetty-server | = 9.3.24.v20180605 |
pkg:maven/org.eclipse.jetty/jetty-server | = 9.2.25.v20180606 |
- ID
- MAVEN:GHSA-6X9X-8QW9-9PP6
- Severity
- critical
- URL
- https://github.com/advisories/GHSA-6x9x-8qw9-9pp6
- Published
-
2018-10-19T16:16:38
(6 years ago) - Modified
-
2023-03-09T20:35:04
(18 months ago) - Rights
- Maven Security Team
- Other Advisories
Type | Package URL | Namespace | Name / Product | Version | Distribution / Platform | Arch | Patch / Fix |
---|---|---|---|---|---|---|---|
Affected | pkg:maven/org.eclipse.jetty/jetty-server | org.eclipse.jetty | jetty-server | >= 9.4.0 < 9.4.11.v20180605 | |||
Fixed | pkg:maven/org.eclipse.jetty/jetty-server | org.eclipse.jetty | jetty-server | = 9.4.11.v20180605 | |||
Affected | pkg:maven/org.eclipse.jetty/jetty-server | org.eclipse.jetty | jetty-server | >= 9.3.0 < 9.3.24.v20180605 | |||
Fixed | pkg:maven/org.eclipse.jetty/jetty-server | org.eclipse.jetty | jetty-server | = 9.3.24.v20180605 | |||
Affected | pkg:maven/org.eclipse.jetty/jetty-server | org.eclipse.jetty | jetty-server | < 9.2.25.v20180606 | |||
Fixed | pkg:maven/org.eclipse.jetty/jetty-server | org.eclipse.jetty | jetty-server | = 9.2.25.v20180606 |
# CVE | Description | CVSS | EPSS | EPSS Trend (30 days) | Affected Products | Weaknesses | Security Advisories | Exploits | PoC | Pubblication Date | Modification Date |
---|---|---|---|---|---|---|---|---|---|---|---|
# CVE | Description | CVSS | EPSS | EPSS Trend (30 days) | Affected Products | Weaknesses | Security Advisories | PoC | Pubblication Date | Modification Date |