Most recent entries from all

bdu:2024-02254

certfr-2023-avi-1055 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre el…

certfr-2023-avi-1055

CLEANSTART-2026-ID49738 — Security fix for CVE-2023-40167 applied in: apache-hive 4.0.0-r1

Affected: CleanStart: apache-hive

Security vulnerability affects the apache-hive package. This issue is resolved in later releases. See references for vulnerability details.

EUVD-2026-216730

fkie_cve-2023-40167

Jetty is a Java based web server and servlet engine. Prior to versions 9.4.52, 10.0.16, 11.0.16, and 12.0.1, Jetty accepts the `+` character proceeding the content-length value in a HTTP/1 header field. This is more permissive than allowed by the RFC and other servers routinely reject such requests with 400 responses. There is no known exploit scenario, but it is conceivable that request smuggling could result if jetty is used in combination with a server that does not close the connection after sending such a 400 response. Versions 9.4.52, 10.0.16, 11.0.16, and 12.0.1 contain a patch for this issue. There is no workaround as there is no known exploit scenario.

GHSA-hmr7-m48g-48f6 — Jetty accepts "+" prefixed value in Content-Length

Affected: Maven: org.eclipse.jetty:jetty-http

### Impact

Jetty accepts the '+' character proceeding the content-length value in a HTTP/1 header field. This is more permissive than allowed by the RFC and other servers routinely reject such requests with 400 responses. There is no known exploit scenario, but it is conceivable that request smuggling could result if jetty is used in combination with a server that does not close the connection after sending such a 400 response.

### Workarounds

There is no workaround as there is no known exploit scenario.

### Original Report

[RFC 9110 Secion 8.6](https://www.rfc-editor.org/rfc/rfc9110#section-8.6) defined the value of Content-Length header should be a string of 0-9 digits. However we found that Jetty accepts "+" prefixed Content-Length, which could lead to potential HTTP request smuggling.

Payload:

``` POST / HTTP/1.1 Host: a.com Content-Length: +16 Connection: close 0123456789abcdef ```

When sending this payload to Jetty, it can successfully parse and identify the length.

When sending this payload to NGINX, Apache HTTPd or other HTTP servers/parsers, they will return 400 bad request.

This behavior can lead to HTTP request smuggling and can be leveraged to bypass WAF or IDS.

gsd-2023-40167

OESA-2024-2268 — jetty security update

Affected: openEuler:20.03-LTS-SP4: jetty

%global desc \ Jetty is a 100% Java HTTP Server and Servlet Container. This means that you\ do not need to configure and run a separate web server (like Apache) in order\ to use Java, servlets and JSPs to generate dynamic content. Jetty is a fully\ featured web server for static and dynamic content. Unlike separate\ server/container solutions, this means that your web server and web\ application run in the same process, without interconnection overheads\ and complications. Furthermore, as a pure java component, Jetty can be simply\ included in your application for demonstration, distribution or deployment.\ Jetty is available on all Java supported platforms. \ %global extdesc \\ \ This package contains Security Fix(es): Jetty is a java based web server and servlet engine. In affected versions servlets with multipart support (e.g. annotated with `@MultipartConfig`) that call `HttpServletRequest.getParameter()` or `HttpServletRequest.getParts()` may cause `OutOfMemoryError` when the client sends a multipart request with a part that has a name but no filename and very large content. This happens even with the default settings of `fileSizeThreshold=0` which should stream the whole part content to disk. An attacker client may send a large multipart request and cause the server to throw `OutOfMemoryError`. However, the server may be able to recover after the `OutOfMemoryError` and continue its service -- although it may take some time. This issue has been patched in versions…

openSUSE-SU-2024:13329-1 — jetty-annotations-9.4.53-1.1 on GA media

jetty-annotations-9.4.53-1.1 on GA media

RHSA-2023:5441 — Red Hat Security Advisory: Red Hat Integration Camel for Spring Boot 4.0.0 release and security update

batik: Server-Side Request Forgery vulnerability batik: Server-Side Request Forgery vulnerability apache-ivy: XML External Entity vulnerability jetty-server: OutOfMemoryError for large multipart without filename read via request.getParameter() jetty-server: Cookie parsing of quoted values can exfiltrate values from other cookies apache-johnzon: Prevent inefficient internal conversion from BigDecimal at large scale netty: SniHandler 16MB allocation leads to OOM jetty: Improper validation of HTTP/1 content-length

UBUNTU-CVE-2023-40167

Affected: Ubuntu:16.04:LTS: jetty9, Ubuntu:18.04:LTS: jetty9, Ubuntu:20.04:LTS: jetty9, Ubuntu:22.04:LTS: jetty9

WID-SEC-W-2023-2359 — Eclipse Jetty: Mehrere Schwachstellen

Ein entfernter authentifizierter Angreifer kann mehrere Schwachstellen in Eclipse Jetty ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen oder einen HTTP-Cache-Poison-Angriff durchzuführen.