A remote attacker can supply specially crafted transfer-encoding chunks to Eclipse Jetty that may bypass the authorization checks of an intermediary caching proxy.

🗓️ 29 Aug 2023 00:00:00Reported by Broadcom Security ResponseType

broadcom

broadcom🔗 support.broadcom.com👁 34 Views

Eclipse Jetty vulnerability in handling transfer-encoding chunks for bypassing authorization checks

Reporter	Title	Published	Views	Family All 68
IBM Security Bulletins	Security Bulletin: IBM Storage Protect Server is vulnerable to various attacks due to Eclipse jetty	21 Jun 202318:36	–	ibm
IBM Security Bulletins	Security Bulletin: Tivoli Netcool/Omnibus installation contains vulnerable Eclipse Jetty code libraries (Multiple CVEs)	7 Jul 202217:38	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cognos Command Center is affected by multiple vulnerabilities	4 May 202320:23	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar SIEM is vulnerable to Using Components with Known Vulnerabilities	7 Oct 202020:49	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security Guardium Insights is affected by a Components with known vulnerabilities	6 Oct 202112:30	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities in Eclipse Jetty affect IBM Security Directory Integrator	15 May 202400:45	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar SIEM is vulnerable to Jetty Vulnerabilities (CVE-2017-7656, CVE-2017-7657, CVE-2017-7658, CVE-2018-12536)	6 Nov 201919:05	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Jasper used in Jetty 8.1.3 Server where Rational Synergy is deployed	22 Dec 202018:18	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Eclipse Jetty affect the IBM InfoSphere Information Server installers	16 Oct 201820:00	–	ibm
IBM Security Bulletins	Security Bulletin: Provision to add https and Secure Flag to bayeux_browser cookie for IBM Control Desk.	19 Sep 202220:54	–	ibm

29 Aug 2023 18:37Current

7High risk

Vulners AI Score7

CVSS 3.19.8

EPSS0.06845

remote attacker specially crafted chunks eclipse jetty vulnerability integer overflow intermediary caching proxy authorization bypass brocade sannav security update vulnerable components software