Fluid Attacks Database

Description

Jetty vulnerable to cache poisoning due to inconsistent HTTP request handling (HTTP Request Smuggling) Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), contain an HTTP Request Smuggling Vulnerability that can result in cache poisoning.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
debian 12	jetty9	>=0 <9.2.25-1	9.2.25-1
debian 13	jetty9	>=0 <9.2.25-1	9.2.25-1
debian 14	jetty9	>=0 <9.2.25-1	9.2.25-1
maven	org.eclipse.jetty:jetty-server	>=0 <9.3.24.v20180605 \|\| >=9.4.0 <9.4.11.v20180605	9.3.24.v20180605, 9.4.11.v20180605
debian 11	jetty9	>=0 <9.2.25-1	9.2.25-1
rpm rhel7	jetty	-	-
rpm rhel6	jetty-eclipse	-	-

Aliases

1. CVE-2017-76562. NVD-2017-76563. OSV-DEBIAN-2017-76564. OSV-2017-76565. GHSA-84q7-p226-4x5w6. GCVE-2017-76567. SECURITY-TRACKER-CVE-2017-7656

References

1. https://bugs.eclipse.org/bugs/show_bug.cgi?id=5356672. https://lists.apache.org/thread.html/053d9ce4d579b02203db18545fee5e33f35f2932885459b74d1e4272@%3Cissues.activemq.apache.org%3E3. https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451@%3Csolr-user.lucene.apache.org%3E4. https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe@%3Ccommits.druid.apache.org%3E5. https://lists.apache.org/thread.html/rbf4565a0b63f9c8b07fab29352a97bbffe76ecafed8b8555c15b83c6@%3Cissues.maven.apache.org%3E6. https://security.netapp.com/advisory/ntap-20181014-00017. https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03953en_us8. https://www.debian.org/security/2018/dsa-42789. https://www.oracle.com/security-alerts/cpuoct2020.html10. https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html11. http://www.securitytracker.com/id/1041194