swagger-api / swagger-api/swagger-codegen
CVE-2017-7657 (High) detected in jetty-http-9.2.28.v20190418.jar, jetty-server-9.2.28.v20190418.jar
Nobody has claimed this yet.
- Dominant language
- Mustache
- Stars
- 17.8k
- Forks
- 6k
- PR merge metrics
- No merged PRs in 30d
Description
CVE-2017-7657 - High Severity Vulnerability
Vulnerable Libraries - jetty-http-9.2.28.v20190418.jar, jetty-server-9.2.28.v20190418.jar
jetty-http-9.2.28.v20190418.jar
Administrative parent pom for Jetty modules
Library home page: http://www.eclipse.org/jetty
Path to vulnerable library: /target/lib/jetty-http-9.2.28.v20190418.jar
Dependency Hierarchy:
- ❌ jetty-http-9.2.28.v20190418.jar (Vulnerable Library)
jetty-server-9.2.28.v20190418.jar
The core jetty server artifact.
Library home page: http://www.eclipse.org/jetty
Path to vulnerable library: /target/lib/jetty-server-9.2.28.v20190418.jar
Dependency Hierarchy:
- ❌ jetty-server-9.2.28.v20190418.jar (Vulnerable Library)
Found in HEAD commit: 4b7a8d7d7384aa6a27d6309c35ade0916edae7ed
Found in base branch: 3.0.0
Vulnerability Details
In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), transfer-encoding chunks are handled poorly. The chunk length parsing was vulnerable to an integer overflow. Thus a large chunk size could be interpreted as a smaller chunk size and content sent as chunk body could be interpreted as a pipelined request. If Jetty was deployed behind an intermediary that imposed some authorization and that intermediary allowed arbitrarily large chunks to be passed on unchanged, then this flaw could be used to bypass the authorization imposed by the intermediary as the fake pipelined request would not be interpreted by the intermediary as a request.
Publish Date: 2018-06-26
URL: CVE-2017-7657
CVSS 3 Score Details (9.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://bugs.eclipse.org/bugs/show_bug.cgi?id=535668
Release Date: 2018-06-26
Fix Resolution: 9.3.24.v20180605
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing the dependency declaration that produces target/lib/jetty-http-9.2.28.v20190418.jar and target/lib/jetty-server-9.2.28.v20190418.jar, using the referenced HEAD commit as context. Upgrade Jetty to a version containing the suggested fix, 9.3.24.v20180605 or later, then rerun the dependency vulnerability scan and confirm CVE-2017-7657 is no longer reported.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100