Bug 1595621 (CVE-2017-7658)

Summary:	CVE-2017-7658 jetty: Incorrect header handling
Product:	[Other] Security Response	Reporter:	Andrej Nemec <anemec>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	abergmann, aileenc, bkearney, chazlett, drieden, ggainey, gvarsami, hhorak, java-maint, java-sig-commits, jcoleman, jjohnstn, jorton, jwon, kconner, krzysztof.daniel, ldimaggi, meissner, mizdebsk, nwallace, pjindal, rwagner, sochotni, tcunning, tkirby, tlestach
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	jetty 9.2.25.v20180606, jetty 9.3.24.v20180605, jetty 9.4.11.v20180605	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-09-17 14:41:04 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1595622, 1642093, 1642108
Bug Blocks:	1595623, 1658211, 1829506

Description Andrej Nemec 2018-06-27 08:40:40 UTC

In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), when presented with two content-lengths headers, Jetty ignored the second. When presented with a content-length and a chunked encoding header, the content-length was ignored (as per RFC 2616). If an intermediary decided on the shorter length, but still passed on the longer body, then body content could be interpreted by Jetty as a pipelined request. If the intermediary was imposing authorization, the fake pipelined request would bypass that authorization.

Upstream issue:

https://bugs.eclipse.org/bugs/show_bug.cgi?id=535669

Comment 1 Andrej Nemec 2018-06-27 08:41:38 UTC

Created jetty tracking bugs for this issue:

Affects: fedora-all [bug 1595622]

Comment 8 Chess Hazlett 2020-06-16 16:12:21 UTC

Statement:

This issue affects the versions of jetty embedded in the nutch package as shipped with Red Hat Satellite 5. The nutch service is not exposed, as such exploitation is difficult, Red Hat Product Security has rated this issue as having security impact of Low. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

This issue affects the version of jetty in Red Hat Data Grid 7's agent-bond utility, which is deprecated and only available for backward compatibility. Customers should use Prometheus JMX instead. This flaw does not affect Red Hat Data Grid 8.

Comment 9 errata-xmlrpc 2020-09-17 13:07:54 UTC

This issue has been addressed in the following products:

  Red Hat Data Grid 7.3.7

Via RHSA-2020:3779 https://access.redhat.com/errata/RHSA-2020:3779

Comment 10 Product Security DevOps Team 2020-09-17 14:41:04 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2017-7658