CRITICAL✓ PATCH🇵🇱 Wersja polska

CVE-2017-7658

CVSS 9.8v3.1pub. 2018-06-26upd. 2024-11-21

In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), when presented with two content-lengths headers, Jetty ignored the second. When presented with a content-length and a chunked encoding header, the content-length was ignored (as per RFC 2616). If an intermediary decided on the shorter length, but still passed on the longer body, then body content could be interpreted by Jetty as a pipelined request. If the intermediary was imposing authorization, the fake pipelined request would bypass that authorization.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Debian

    OS
    Debian
    9.0

  • Eclipse Jetty

    APP
    Eclipse
    ≤ 9.2.269.3.0 – 9.3.24 (bez)9.4.0 – 9.4.11 (bez)

  • HP Xp P9000

    HW
    Hp
    wszystkie wersje

  • HP Xp P9000 Command View

    APP
    Hp
    8.4.0-00 – 8.6.2-00

  • Netapp E Series Santricity Management

    APP
    Netapp
    wszystkie wersje

  • Netapp E Series Santricity Os Controller

    APP
    Netapp
    11.0 – 11.50.1

  • Netapp E Series Santricity Web Services

    APP
    Netapp
    wszystkie wersje

  • Netapp Hci Management Node

    APP
    Netapp
    wszystkie wersje

  • Netapp Hci Storage Node

    APP
    Netapp
    wszystkie wersje

  • Netapp Oncommand System Manager

    APP
    Netapp
    3.0 – 3.1.3

  • Netapp Oncommand Unified Manager For 7 Mode

    APP
    Netapp
    wszystkie wersje

  • Netapp Santricity Cloud Connector

    APP
    Netapp
    wszystkie wersje

  • Netapp Snapcenter

    APP
    Netapp
    wszystkie wersje

  • Netapp Snap Creator Framework

    APP
    Netapp
    wszystkie wersje

  • Netapp Snapmanager

    APP
    Netapp
    wszystkie wersje

  • Netapp Solidfire

    APP
    Netapp
    wszystkie wersje

  • Netapp Storage Services Connector

    APP
    Netapp
    wszystkie wersje

  • Oracle Rest Data Services

    APP
    Oracle
    11.2.0.412.1.0.212.2.0.118c

  • Oracle Retail Xstore Payment

    APP
    Oracle
    3.3

  • Oracle Retail Xstore Point Of Service

    APP
    Oracle
    15.016.017.07.1
🟢
PATCH AVAILABLE
Vendor update available. Deploy in standard maintenance cycle.
CWE
References

Related vulnerabilities

CVE-2026-24061CRITICAL9.8⚠ KEVPL ✓ten sam produkt

GNU Inetutils telnetd: ominięcie uwierzytelnienia przez zmienną USER

CVE-2025-32463CRITICAL9.3⚠ KEVPL ✓ten sam produkt

Sudo: eskalacja uprawnień do root poprzez opcję --chroot (CVE-2025-32463)

CVE-2025-49113CRITICAL9.9⚠ KEVPL ✓ten sam produkt

RCE przez deserializację PHP w Roundcube Webmail (parametr _from)

CVE-2025-32433CRITICAL10.0⚠ KEVPL ✓ten sam produkt

Erlang/OTP SSH — nieuwierzytelniony RCE (CVSS 10.0)

CVE-2025-24201CRITICAL10.0⚠ KEVPL ✓ten sam produkt

Apple WebKit: out-of-bounds write umożliwiający ucieczkę z sandbox przeglądarki