HTTP request smuggling attack in Jetty - CVE-2017-7658

Vulnerability identifier: #VU13529

CSH Severity: Low

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-7658

CWE-ID: CWE-444

Exploitation vector: Remote access

Exploit availability: No public exploit available

The disclosed vulnerability allows a remote attacker to conduct an HTTP request smuggling attack on the target system.

The vulnerability exists due to improper handling HTTP requests that contain more than one content-length header. A remote attacker can send a specially crafted HTTP request that contains a transfer-encoding header and a content-length header, cause the software and an upstream HTTP agent to misinterpret the boundary of the request and to poison the web cache on the system, which could be used to conduct further attacks.

Jetty
Debian Linux
Fedora
Security Directory Integrator
Oracle Retail Xstore Payment
Cloudera Observability with IBM
IBM Security Verify Directory
Dell Support Assist Enterprise
IBM Security Directory Suite
BIG-IP
Dell Secure Connect Gateway
IBM Tivoli Netcool/OMNIbus WebGUI
IBM Cloud Application Performance Management (APM)
IBM Spectrum Protect Storage Agent
IBM Security Verify Governance
BIG-IQ Centralized Management
Oracle REST Data Services
Cloudera Data Platform Private Cloud Base for IBM
jetty
IBM Cognos Command Center

The vulnerability is addressed in the versions 9.2.25.v2018060, 9.3.24.v20180605 and 9.4.11.v20180605.

Jetty - addressed in versions 9.2.25.v2018060, 9.3.24.v20180605, 9.4.11.v20180605
Dell Secure Connect Gateway - update to 5.12.00.10
IBM Tivoli Netcool/OMNIbus WebGUI - update to 8.1.0.29
Dell Support Assist Enterprise - update to 2.0.21
Cloudera Data Platform Private Cloud Base for IBM - update to 7.1.7 SP2 Cumulative Hotfix 16
IBM Security Directory Suite - update to 8.0.1.21
IBM Cloud Application Performance Management (APM) - update to 8.1.4.0.15
IBM Spectrum Protect Storage Agent - update to 8.1.19
jetty - addressed in versions 9.4.11-2.v20180605.fc27, 9.4.11-2.v20180605.fc28
IBM Security Verify Governance - update to 10.0.1.0.3
IBM Cognos Command Center - update to 10.2.4 Fix Pack 1 IF17

• http://dev.eclipse.org/mhonarc/lists/jetty-announce/msg00123.html

• Multiple vulnerabilities in Eclipse Jetty
• Debian update for jetty9
• Multiple vulnerabilities in Oracle REST Data Services
• Multiple vulnerabilities in F5 BIG-IP iControl REST
• Multiple vulnerabilities in F5 BIG-IQ Centralized Management (restjavad)
• Multiple vulnerabilities in IBM Tivoli Netcool/OMNIbus
• Multiple vulnerabilities in DELL Secure Connect Gateway Security
• HTTP request smuggling attack in Dell EMC SupportAssist Enterprise
• Multiple vulnerabilities in IBM Security Verify Governance
• Multiple vulnerabilities in IBM Cognos Command Center
• Multiple vulnerabilities in IBM Storage Protect Server
• Multiple vulnerabilities in IBM Application Performance Management
• Multiple vulnerabilities in IBM Security Directory Integrator
• Multiple vulnerabilities in IBM Security Verify Directory
• Multiple vulnerabilities in IBM Security Directory Suite
• Fedora 28 update for jetty
• Fedora 27 update for jetty
• Multiple vulnerabilities in IBM Cloudera Observability on Premises with IBM
• Multiple vulnerabilities in Cloudera Data Platform Private Cloud Base with IBM (CDP)
• Multiple vulnerabilities in Oracle Retail Xstore Payment