CVE-2017-7658

In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), when presented with two content-lengths headers, Jetty ignored the second. When presented with a content-length and a chunked encoding header, the content-length was ignored (as per RFC 2616). If an intermediary decided on the shorter length, but still passed on the longer body, then body content could be interpreted by Jetty as a pipelined request. If the intermediary was imposing authorization, the fake pipelined request would bypass that authorization.

• Debian

  OS
  Debian
  9.0

• Eclipse Jetty

  APP
  Eclipse
  ≤ 9.2.269.3.0 – 9.3.24 (bez)9.4.0 – 9.4.11 (bez)

• HP Xp P9000

  HW
  Hp
  wszystkie wersje

• HP Xp P9000 Command View

  APP
  Hp
  8.4.0-00 – 8.6.2-00

• Netapp E Series Santricity Management

  APP
  Netapp
  wszystkie wersje

• Netapp E Series Santricity Os Controller

  APP
  Netapp
  11.0 – 11.50.1

• Netapp E Series Santricity Web Services

  APP
  Netapp
  wszystkie wersje

• Netapp Hci Management Node

  APP
  Netapp
  wszystkie wersje

• Netapp Hci Storage Node

  APP
  Netapp
  wszystkie wersje

• Netapp Oncommand System Manager

  APP
  Netapp
  3.0 – 3.1.3

• Netapp Oncommand Unified Manager For 7 Mode

  APP
  Netapp
  wszystkie wersje

• Netapp Santricity Cloud Connector

  APP
  Netapp
  wszystkie wersje

• Netapp Snapcenter

  APP
  Netapp
  wszystkie wersje

• Netapp Snap Creator Framework

  APP
  Netapp
  wszystkie wersje

• Netapp Snapmanager

  APP
  Netapp
  wszystkie wersje

• Netapp Solidfire

  APP
  Netapp
  wszystkie wersje

• Netapp Storage Services Connector

  APP
  Netapp
  wszystkie wersje

• Oracle Rest Data Services

  APP
  Oracle
  11.2.0.412.1.0.212.2.0.118c

• Oracle Retail Xstore Payment

  APP
  Oracle
  3.3

• Oracle Retail Xstore Point Of Service

  APP
  Oracle
  15.016.017.07.1