In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), HTTP/0.9 is handled poorly. An HTTP/1 style request line (i.e. method space URI space version) that declares a version of HTTP/0.9 was accepted and treated as a 0.9 request. If deployed behind an intermediary that also accepted and passed through the 0.9 version (but did not act on it), then the response sent could be interpreted by the intermediary as HTTP/1 headers. This could be used to poison the cache if the server allowed the origin client to generate arbitrary content in the response.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default
    configuration with RFC2616 compliance enabled), HTTP/0.9 is handled poorly. An HTTP/1 style request line
    (i.e. method space URI space version) that declares a version of HTTP/0.9 was accepted and treated as a
    0.9 request. If deployed behind an intermediary that also accepted and passed through the 0.9 version (but
    did not act on it), then the response sent could be interpreted by the intermediary as HTTP/1 headers.
    This could be used to poison the cache if the server allowed the origin client to generate arbitrary
    content in the response. (CVE-2017-7656)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default     configuration with RFC2616 compliance enabled), HTTP/0.9 is handled poorly. An HTTP/1 style request line     (i.e. method space URI space version) that declares a version of HTTP/0.9 was accepted and treated as a     0.9 request. If deployed behind an intermediary that also accepted and passed through the 0.9 version (but     did not act on it), then the response sent could be interpreted by the intermediary as HTTP/1 headers.
    This could be used to poison the cache if the server allowed the origin client to generate arbitrary     content in the response. (CVE-2017-7656)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of F5 Networks BIG-IP installed on the remote host is prior to 15.1.9 / 16.1.4 / 17.1.1. It is, therefore, affected by a vulnerability as referenced in the K21054458 advisory.

    In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default     configuration with RFC2616 compliance enabled), HTTP/0.9 is handled poorly. An HTTP/1 style request line     (i.e. method space URI space version) that declares a version of HTTP/0.9 was accepted and treated as a     0.9 request. If deployed behind an intermediary that also accepted and passed through the 0.9 version (but     did not act on it), then the response sent could be interpreted by the intermediary as HTTP/1 headers.
    This could be used to poison the cache if the server allowed the origin client to generate arbitrary     content in the response.(CVE-2017-7656)ImpactPrivilege escalation is possible, as the pipelined request     would bypass the authorization.

Tenable has extracted the preceding description block directly from the F5 Networks BIG-IP security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Update to upstream version 9.4.11. Fixes CVE-2017-7656, CVE-2017-7657, CVE-2017-7658.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple vulnerabilities were discovered in Jetty, a Java servlet engine and webserver which could result in HTTP request smuggling.

Update to upstream version 9.4.11. Fixes CVE-2017-7656, CVE-2017-7657, CVE-2017-7658, CVE-2018-12538.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
422329	SCA: security update for org.eclipse.jetty:jetty-server (GHSA-84q7-p226-4x5w)	Tenable Cloud Security	SCA Checks	high
422329	SCA: security update for org.eclipse.jetty:jetty-server (GHSA-84q7-p226-4x5w)	Tenable Self-Hosted Container Security	SCA Checks	high
221570	Linux Distros Unpatched Vulnerability : CVE-2017-7656	Nessus	Misc.	high
159886	F5 Networks BIG-IP : Eclipse Jetty vulnerability (K21054458)	Nessus	F5 Networks Local Security Checks	high
120388	Fedora 28 : jetty (2018-48b73ed393)	Nessus	Fedora Local Security Checks	critical
111987	Debian DSA-4278-1 : jetty9 - security update	Nessus	Debian Local Security Checks	critical
111048	Fedora 27 : jetty (2018-93a507fd0f)	Nessus	Fedora Local Security Checks	critical

Detections

Analytics

CVE-2017-7656

high

Tenable Plugins

high

high

high

high

critical

critical

critical