Jetty accepts "+" prefixed value in Content-Length

🗓️ 14 Sep 2023 16:17:27Reported by GitHub Advisory DatabaseType

github

github🔗 github.com👁 42 Views

Jetty allows "+" prefixed Content-Length leading to potential HTTP request smugglin

Reporter	Title	Published	Views	Family All 154
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for October 2023	26 Mar 202504:03	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities Addressed in IBM Tivoli Network Manager IP Edition (ITNM) version 4.2 Fix Pack 20 (4.2.0.20)	11 Nov 202411:31	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in eclipse jetty affect IBM Business Automation Workflow	3 Jun 202413:36	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Operational Decision Manager October 2023 - Multiple CVEs addressed	19 Oct 202311:13	–	ibm
IBM Security Bulletins	Security Bulletin: An Eclipse Jetty vulnerability affects IBM Rational Functional Tester	18 Dec 202312:04	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM StreamSets Data Collector	22 Oct 202512:16	–	ibm
IBM Security Bulletins	Security Bulletin: Due to the use of jetty IBM webMethods BPM is vulnerable to multiple vulnerabilities	11 Mar 202620:59	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery Cartridge for IBM Cloud Pak for Data affected by vulnerability in Eclipse Jetty	29 Nov 202314:46	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Cloud Pak for Multicloud Management	20 Mar 202517:08	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Control Center is affected by vulnerabilities in its dependencies (CVE-2022-45688, CVE-2023-28439, CVE-2023-33201, CVE-2023-41900, CVE-2023-36479, CVE-2023-40167, CVE-2023-36478, )	24 Mar 202514:16	–	ibm

Vulners

Node

org.eclipse.jetty jetty-httpmaven

OR

org.eclipse.jetty jetty-httpRange11.0.0–11.0.15maven

OR

org.eclipse.jetty jetty-httpRange10.0.0–10.0.15maven

OR

org.eclipse.jetty jetty-httpRange9.0.0–9.4.51maven

Source	Link
github	www.github.com/eclipse/jetty.project/security/advisories/GHSA-hmr7-m48g-48f6
rfc-editor	www.rfc-editor.org/rfc/rfc9110
nvd	www.nvd.nist.gov/vuln/detail/CVE-2023-40167
debian	www.debian.org/security/2023/dsa-5507
lists	www.lists.debian.org/debian-lts-announce/2023/09/msg00039.html
github	www.github.com/advisories/GHSA-hmr7-m48g-48f6

06 Nov 2023 05:01Current

6.7Medium risk

Vulners AI Score6.7

CVSS 3.15.3

EPSS0.04575

SSVC

jetty content-length http request smuggling rfc 9110 connection closure waf ids rfc http/1 header payload.