Bug 2239634 (CVE-2023-40167)
| Summary: | CVE-2023-40167 jetty: Improper validation of HTTP/1 content-length | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Pedro Sampaio <psampaio> |
| Component: | vulnerability | Assignee: | Sayan Biswas <sabiswas> |
| Status: | NEW --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | aileenc, alampare, alazarot, asatyam, ataylor, bbuckingham, bcourt, boliveir, caswilli, chazlett, chfoley, dfreiber, dhanak, diagrawa, drichtar, dsimansk, ehelms, emingora, fjansen, fmariani, fmongiar, gjospin, gmalinko, ibek, janstey, jburrell, jnethert, jpoth, jrokos, jross, jscholz, jsherril, kaycoth, kverlaen, lbacciot, lball, lzap, matzew, mhulan, mnovotny, nmoumoul, orabin, owatkins, pcreech, pdelbell, pdrozd, peholase, pjindal, pskopek, rchan, rguimara, rhuss, rjohnson, rkieley, rogbas, rowaters, sdawley, sthorger, swoodman, tcunning, vkumar, yfang |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | jetty 9.4.52, jetty 10.0.16, jetty 11.0.6, jetty 12.0.1 | Doc Type: | If docs needed, set a value |
| Doc Text: |
A flaw was found in Jetty that permits a plus sign (+) preceding the content-length value in a HTTP/1 header field, which is non-standard and more permissive than RFC. This issue could allow an attacker to request smuggling in conjunction with a server that does not close connections after 400 responses.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2240264, 2247377, 2257318 | ||
| Bug Blocks: | 2239846 | ||
|
Description
Pedro Sampaio
2023-09-19 13:49:17 UTC
Jetty is a Java based web server and servlet engine. Prior to versions 9.4.52, 10.0.16, 11.0.16, and 12.0.1, Jetty accepts the `+` character proceeding the content-length value in a HTTP/1 header field. This is more permissive than allowed by the RFC and other servers routinely reject such requests with 400 responses. There is no known exploit scenario, but it is conceivable that request smuggling could result if jetty is used in combination with a server that does not close the connection after sending such a 400 response. Versions 9.4.52, 10.0.16, 11.0.16, and 12.0.1 contain a patch for this issue. There is no workaround as there is no known exploit scenario. References: https://www.rfc-editor.org/rfc/rfc9110#section-8.6 https://github.com/eclipse/jetty.project/security/advisories/GHSA-hmr7-m48g-48f6 This issue has been addressed in the following products: RHINT Camel-Springboot 4.0.0 Via RHSA-2023:5441 https://access.redhat.com/errata/RHSA-2023:5441 This issue has been addressed in the following products: Red Hat Integration Via RHSA-2023:5780 https://access.redhat.com/errata/RHSA-2023:5780 This issue has been addressed in the following products: Red Hat JBoss AMQ Via RHSA-2023:5946 https://access.redhat.com/errata/RHSA-2023:5946 This issue has been addressed in the following products: Red Hat Fuse 7.12.1 Via RHSA-2023:7247 https://access.redhat.com/errata/RHSA-2023:7247 This issue has been addressed in the following products: Red Hat AMQ Streams 2.6.0 Via RHSA-2023:7678 https://access.redhat.com/errata/RHSA-2023:7678 This issue has been addressed in the following products: AMQ Clients 3.y for RHEL 8 AMQ Clients 3.y for RHEL 9 Via RHSA-2023:7697 https://access.redhat.com/errata/RHSA-2023:7697 This issue has been addressed in the following products: OpenShift Developer Tools and Services for OCP 4.12 Via RHSA-2024:0778 https://access.redhat.com/errata/RHSA-2024:0778 This issue has been addressed in the following products: Red Hat Satellite 6.14 for RHEL 8 Via RHSA-2024:0797 https://access.redhat.com/errata/RHSA-2024:0797 This issue has been addressed in the following products: Red Hat Satellite 6.15 for RHEL 8 Via RHSA-2024:2010 https://access.redhat.com/errata/RHSA-2024:2010 This issue has been addressed in the following products: Red Hat Fuse 7.13.0 Via RHSA-2024:3354 https://access.redhat.com/errata/RHSA-2024:3354 |