Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
ibmIBM60B88A74EDF5773B6DFF4D61BE3BD53CE790844711A892BEDDB88D4F8B67B612
HistoryJul 24, 2020 - 10:19 p.m.

Security Bulletin: Multiple Vulnerabilities affect IBM Sterling External Authentication Server

2020-07-2422:19:08
www.ibm.com
22

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

JSON

Summary

Three Eclipse Jetty request smuggling vulnerabilities were addressed by IBM Sterling External Authentication Server.

Vulnerability Details

CVE-ID: CVE-2017-7656
Description: Eclipse Jetty is vulnerable to HTTP request smuggling, caused by a flaw in the HTTP/1.x Parser. By sending a specially-crafted request, an attacker could exploit this vulnerability to poison the web cache, bypass web application firewall protection, and conduct XSS attacks.
CVSS Base Score: 6.5
CVSS Temporal Score: <https://exchange.xforce.ibmcloud.com/vulnerabilities/145520&gt; for more information
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)

CVE-ID: CVE-2017-7657
Description: Eclipse Jetty is vulnerable to HTTP request smuggling, caused by improper handling of Chunked Transfer-Encoding chunk size. By sending a specially-crafted request, an attacker could exploit this vulnerability to poison the web cache, bypass web application firewall protection, and conduct XSS attacks.
CVSS Base Score: 6.5
CVSS Temporal Score: <https://exchange.xforce.ibmcloud.com/vulnerabilities/145521&gt; for more information
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)

CVE-ID: CVE-2017-7658
Description: Eclipse Jetty is vulnerable to HTTP request smuggling, caused by a flaw when handling more than one Content-Length headers. By sending a specially-crafted request, an attacker could exploit this vulnerability to poison the web cache, bypass web application firewall protection, and conduct XSS attacks.
CVSS Base Score: 6.5
CVSS Temporal Score: <https://exchange.xforce.ibmcloud.com/vulnerabilities/145522&gt; for more information
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)

Affected Products and Versions

IBM Sterling External Authentication Server 2.4.3 through 2.4.3.2 iFix 2

IBM Sterling External Authentication Server 2.4.2 through 2.4.2 iFix 11

Remediation/Fixes

Product

|

VRMF

|

APAR

|

How to acquire fix

—|—|—|—

IBM Sterling_ External Authentication Server_

|

2.4.3.2

|

iFix 3

|

Fix Central

IBM Sterling_ External Authentication Server_

|

2.4.2.0

|

iFix 12

|

Fix Central

Workarounds and Mitigations

None.

Related

nessus 6
ibm 23
debian 1
openvas 5
osv 7
fedora 2
f5 2
cve 3
redhatcve 3
prion 3
broadcom 1
github 3
ubuntucve 3
debiancve 3
veracode 3
atlassian 1
symantec 1
hackerone 1
redhat 2
thn 1
oracle 4
nessus
nessus
Debian DSA-4278-1 : jetty9 - security update
2018-08-20 00:00:00
Fedora 28 : jetty (2018-48b73ed393)
2019-01-03 00:00:00
F5 Networks BIG-IP : Eclipse Jetty vulnerabilities (K10002140)
2022-04-05 00:00:00
ibm
ibm
Security Bulletin: Publicly disclosed vulnerability found by vFinder in IBM eDiscovery Analyzer
2020-04-29 10:15:33
Security Bulletin: Vulnerabilities in Eclipse Jetty affect the IBM InfoSphere Information Server installers
2018-10-16 20:00:01
Security Bulletin: Multiple Vulnerabilities affect IBM Sterling Secure Proxy
2020-07-24 22:19:08
debian
debian
[SECURITY] [DSA 4278-1] jetty9 security update
2018-08-19 21:21:38
openvas
openvas
Debian Security Advisory DSA 4278-1 (jetty9 - security update)
2018-08-19 00:00:00
Fedora Update for jetty FEDORA-2018-48b73ed393
2018-07-15 00:00:00
Fedora Update for jetty FEDORA-2018-93a507fd0f
2018-07-15 00:00:00
osv
osv
jetty9 - security update
2018-08-19 00:00:00
CVE-2017-7657
2018-06-26 16:29:00
Critical severity vulnerability that affects org.eclipse.jetty:jetty-server
2018-10-19 16:15:34
fedora
fedora
[SECURITY] Fedora 28 Update: jetty-9.4.11-2.v20180605.fc28
2018-07-12 14:21:30
[SECURITY] Fedora 27 Update: jetty-9.4.11-2.v20180605.fc27
2018-07-12 13:47:39
f5
f5
K10002140 : Eclipse Jetty vulnerabilities CVE-2017-7657 and CVE-2017-7658
2022-04-05 00:00:00
K21054458 : Eclipse Jetty vulnerability CVE-2017-7656
2022-04-19 00:00:00
cve
cve
CVE-2017-7657
2018-06-26 16:29:00
CVE-2017-7658
2018-06-26 17:29:00
CVE-2017-7656
2018-06-26 15:29:00
redhatcve
redhatcve
CVE-2017-7658
2018-06-27 08:49:18
CVE-2017-7657
2019-10-08 10:49:34
CVE-2017-7656
2018-06-27 09:18:40
prion
prion
Authorization
2018-06-26 17:29:00
Integer overflow
2018-06-26 16:29:00
Default configuration
2018-06-26 15:29:00
broadcom
broadcom
A remote attacker can supply specially crafted transfer-encoding chunks to Eclipse Jetty that may bypass the authorization checks of an intermediary caching proxy.
2023-08-29 00:00:00
github
github
Jetty vulnerable to authorization bypass due to inconsistent HTTP request handling (HTTP Request Smuggling)
2018-10-19 16:16:38
Critical severity vulnerability that affects org.eclipse.jetty:jetty-server
2018-10-19 16:15:34
Jetty vulnerable to cache poisoning due to inconsistent HTTP request handling (HTTP Request Smuggling)
2018-10-19 16:16:27
ubuntucve
ubuntucve
CVE-2017-7658
2018-06-26 00:00:00
CVE-2017-7657
2018-06-26 00:00:00
CVE-2017-7656
2018-06-26 00:00:00
debiancve
debiancve
CVE-2017-7657
2018-06-26 16:29:00
CVE-2017-7658
2018-06-26 17:29:00
CVE-2017-7656
2018-06-26 15:29:00
veracode
veracode
Request Smuggling
2018-07-19 08:32:02
HTTP Request Smuggling
2018-06-26 14:52:07
HTTP Request Smuggling
2018-06-26 12:30:42
atlassian
atlassian
Cache Poisoning org.eclipse.jetty:jetty-server in Jira Software Data Center and Server
2023-09-26 16:17:11
symantec
symantec
Eclipse Jetty CVE-2017-7656 Security Vulnerability
2018-06-07 00:00:00
hackerone
hackerone
Internet Bug Bounty: Multiple HTTP Smuggling reports
2019-07-17 22:47:10
redhat
redhat
(RHSA-2019:0910) Important: Red Hat Fuse 7.3 security update
2019-04-30 15:17:04
(RHSA-2020:3779) Important: Red Hat Data Grid 7.3.7 security update
2020-09-17 13:03:47
thn
thn
Top 15 Vulnerabilities Attackers Exploited Millions of Times to Hack Linux Systems
2021-08-23 13:27:00
oracle
oracle
Oracle Critical Patch Update Advisory - October 2019
2020-01-22 00:00:00
Oracle Critical Patch Update Advisory - July 2021
2021-07-20 00:00:00
Oracle Critical Patch Update Advisory - October 2020
2020-10-20 00:00:00

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

JSON
Related for 60B88A74EDF5773B6DFF4D61BE3BD53CE790844711A892BEDDB88D4F8B67B612
nessus6ibm23debian1openvas5osv7fedora2f52cve3redhatcve3prion3broadcom1github3ubuntucve3debiancve3veracode3atlassian1symantec1hackerone1redhat2thn1oracle4