Integer Overflow Vulnerability in Eclipse Jetty
Summary
CVE-2017-7657: In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), transfer-encoding chunks are handled poorly. Affects jetty9 across 3 version ranges.
< 9.2.25-1
>= 390f3200cce7f90f1f3ebc78013c1afea2f93db8, < 84205aa28f11a4f31f2a3b86d1bba2cc8ab69827
>= bf9d17540c7ae4c91be30c045a9485aa2030d3e5, < d5fc0523cfa96bfebfbda19606cad384d772f04c
Fixed in 9.2.25-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Eclipse Jetty is a popular Java-based web server and servlet container. It provides a lightweight and scalable platform for hosting web applications. Jetty is widely used in various software systems and frameworks due to its performance and flexibility. However, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled) are vulnerable to an integer overflow issue.
Vulnerability Detail
The vulnerability in Jetty arises from the poor handling of transfer-encoding chunks. The chunk length parsing is susceptible to an integer overflow, allowing a large chunk size to be interpreted as a smaller chunk size. This can lead to content sent as chunk body being interpreted as a pipelined request. If Jetty is deployed behind an intermediary that allows arbitrarily large chunks to pass through unchanged, an attacker can exploit this flaw to bypass the authorization imposed by the intermediary. The fake pipelined request would not be recognized as a request by the intermediary, potentially granting unauthorized access to the system.
How To Fix
Minimum fixed version
9.2.25-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade jetty9Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating Jetty is not immediately feasible, a possible workaround is to configure the intermediary (if present) to limit the chunk size to a reasonable value. By enforcing a maximum chunk size, the risk of integer overflow can be mitigated. However, this workaround should be considered temporary, and updating to the latest version of Jetty is still the recommended solution.
Conclusion
The integer overflow vulnerability in Eclipse Jetty can potentially allow unauthorized access to a system by bypassing intermediary authorization. It is crucial to update Jetty to the latest version (9.2.25-1 or later) to mitigate this vulnerability. If you require further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for jetty9 →
FAQ
Eclipse Jetty is a Java-based web server and servlet container known for its lightweight and scalable architecture. It is widely used in various software systems and frameworks.
Versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled) are vulnerable to this integer overflow issue.
If successfully exploited, this vulnerability can allow an attacker to bypass authorization imposed by an intermediary and gain unauthorized access to the system.
Updating Jetty to version 9.2.25-1 or later is the recommended solution. This update addresses the integer overflow issue and provides a secure implementation of chunk length parsing.
A temporary workaround is to configure the intermediary (if present) to limit the chunk size to a reasonable value. However, updating Jetty to the latest version is still the recommended approach.
References
Related vulnerabilities
Recent vulnerabilities recorded for jetty9.
