CVE-2017-7657: org.eclipse.jetty:jetty-server - Integer Overflow Vulnerability
Summary
CVE-2017-7657: Critical severity vulnerability that affects org.eclipse.jetty:jetty-server. Affects org.eclipse.jetty:jetty-server across 2 version ranges.
< 9.2.25.v20180606
>= 9.3.0, < 9.3.24.v20180605
Fixed in 9.2.25.v20180606 or 9.3.24.v20180605, depending on the release line you run. How to fix ↓
Also tracked for
- jetty9 · Debian:11
The same CVE-2017-7657 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
org.eclipse.jetty:jetty-server is a package in the Maven ecosystem that provides a Java HTTP server and servlet container. It is widely used in web applications and frameworks. This package is vulnerable to an integer overflow vulnerability in versions 9.2.x and older, as well as 9.3.x. The vulnerability lies in the way transfer-encoding chunks are handled, where the chunk length parsing can be manipulated to interpret a large chunk size as a smaller one. This can lead to content sent as chunk body being interpreted as a pipelined request. If Jetty is deployed behind an intermediary that allows arbitrarily large chunks to be passed on unchanged, this flaw can be exploited to bypass authorization imposed by the intermediary.
Vulnerability Detail
The integer overflow vulnerability in org.eclipse.jetty:jetty-server allows an attacker to manipulate chunk sizes and bypass authorization. By sending a large chunk size that is interpreted as a smaller one, the attacker can make the content of the chunk body appear as a pipelined request. This can be exploited when Jetty is deployed behind an intermediary that allows large chunks to pass through unchanged. The impact of this vulnerability is the potential bypassing of authorization mechanisms, allowing unauthorized access to protected resources.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 9.2.25.v201806069.2.25.v20180606 -
>= 9.3.0, < 9.3.24.v201806059.3.24.v20180605
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update to the fixed versions as mentioned in the 'how_to_fix' section.
Conclusion
The integer overflow vulnerability in org.eclipse.jetty:jetty-server can lead to the bypassing of authorization mechanisms, potentially allowing unauthorized access to protected resources. It is crucial to update to the fixed versions mentioned in the 'how_to_fix' section to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.eclipse.jetty:jetty-server →
FAQ
The impact of this vulnerability is the potential bypassing of authorization mechanisms, allowing unauthorized access to protected resources.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities using just the pom.xml file.
No, only versions 9.2.x and older, as well as 9.3.x, are affected. Updating to version 9.2.25.v20180606 or later for 9.2.x and version 9.3.24.v20180605 or later for 9.3.x will fix the vulnerability.
No, there is no known workaround for this vulnerability. It is recommended to update to the fixed versions.
You can find more information about this vulnerability in the GitHub Advisory Database at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-vgg8-72f2-qm23/GHSA-vgg8-72f2-qm23.json
Related vulnerabilities
Recent vulnerabilities recorded for org.eclipse.jetty:jetty-server.
