CVE-2017-7658

In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x
configurations), and 9.4.x (all HTTP/1.x configurations), when presented
with two content-lengths headers, Jetty ignored the second. When presented
with a content-length and a chunked encoding header, the content-length was
ignored (as per RFC 2616). If an intermediary decided on the shorter
length, but still passed on the longer body, then body content could be
interpreted by Jetty as a pipelined request. If the intermediary was
imposing authorization, the fake pipelined request would bypass that
authorization.

Notes