Jetty HTTP/1 Header Field Vulnerability - Potential Request Smuggling Risk
Summary
CVE-2023-40167: Jetty is a Java based web server and servlet engine. Affects jetty9 across 3 version ranges.
< 9.4.39-3+deb11u2
>= 1237b739c787a75a5f9e1f495b3f2c8284761499, < abdcda73818a1a2c705da276edb0bf6581e7997e
>= b9645a17373e4e9b7f30b6c0a07defcea2cb660b, < a2735a9ae9d1afc124974253f1e223e5678be1f4
Fixed in 9.4.39-3+deb11u2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jetty is a widely used Java-based web server and servlet engine that provides a robust platform for running web applications. It is known for its lightweight architecture and scalability, making it a popular choice for developers. However, prior to versions 9.4.52, 10.0.16, 11.0.16, and 12.0.1, Jetty had a vulnerability that allowed the '+' character to precede the content-length value in HTTP/1 header fields, which is not compliant with the RFC standards.
Vulnerability Detail
The vulnerability arises from Jetty's acceptance of the '+' character in HTTP/1 header fields, which is more permissive than the standards dictate. This could potentially lead to request smuggling attacks, especially if Jetty is used in conjunction with another server that does not properly handle such requests. While there are no known exploit scenarios, the risk remains significant due to the nature of HTTP request handling.
How To Fix
Minimum fixed version
9.4.39-3+deb11u2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade jetty9Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability, as it is essential to upgrade to the patched versions to mitigate the risk effectively.
Conclusion
The vulnerability identified in Jetty regarding the handling of the '+' character in HTTP/1 header fields poses a potential risk for request smuggling. Users are strongly advised to upgrade to the latest patched versions to ensure the security of their applications. Regular monitoring for vulnerabilities using tools like Vulert can help maintain application security.
See every vulnerability recorded for jetty9 →
FAQ
The CVSS score of this vulnerability is 5.3, indicating a moderate level of severity.
Versions prior to 9.4.52, 10.0.16, 11.0.16, and 12.0.1 are affected by this vulnerability.
Currently, there is no known exploit scenario for this vulnerability, but the potential for request smuggling exists.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
While there is no workaround available, it is crucial to plan for an upgrade as soon as possible to mitigate the risk associated with this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for jetty9.
