CVE-2021-34428
Summary
| CVE | CVE-2021-34428 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2021-06-22 15:15:00 UTC |
|---|
| Updated | 2023-11-07 03:35:00 UTC |
|---|
| Description | For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, if an exception is thrown from the SessionListener#sessionDestroyed() method, then the session ID is not invalidated in the session ID manager. On deployments with clustered sessions and multiple contexts this can result in a session not being invalidated. This can result in an application used on a shared computer being left logged in. |
|---|
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|
| Pony Mail! |
MISC |
lists.apache.org |
|
| [zookeeper-issues] 20210928 [jira] [Updated] (ZOOKEEPER-4390) CVE-2021-28169 , CVE-2021-28163, - Upgrade jetty to 9.4.42 |
|
lists.apache.org |
|
| SessionListener can prevent a session from being invalidated breaking logout · Advisory · eclipse/jetty.project · GitHub |
CONFIRM |
github.com |
|
| [zookeeper-issues] 20210928 [jira] [Updated] (ZOOKEEPER-4390) CVE-2021-28169 , - Upgrade jetty to 9.4.42 |
|
lists.apache.org |
|
| [zookeeper-issues] 20210928 [jira] [Updated] (ZOOKEEPER-4390) CVE-2021-28169 , CVE-2021-28163, CVE-2021-34428- Upgrade jetty to 9.4.42 |
|
lists.apache.org |
|
| Oracle Critical Patch Update Advisory - April 2022 |
MISC |
www.oracle.com |
|
| CVE-2021-34428 Eclipse Jetty Vulnerability in NetApp Products | NetApp Product Security |
CONFIRM |
security.netapp.com |
|
| Pony Mail! |
MLIST |
lists.apache.org |
|
| [kafka-jira] 20210623 [GitHub] [kafka] dongjinleekr opened a new pull request #10919: KAFKA-12985: CVE-2021-28169 - Upgrade jetty to 9.4.41 |
|
lists.apache.org |
|
| Debian -- Security Information -- DSA-4949-1 jetty9 |
DEBIAN |
www.debian.org |
|
| lists.apache.org/thread.html/r8a1a332899a1f92c8118b0895b144b27a78e3f25b9d58a34... |
|
lists.apache.org |
|
| Pony Mail! |
MLIST |
lists.apache.org |
|
| Pony Mail! |
MLIST |
lists.apache.org |
|
| Oracle Critical Patch Update Advisory - October 2021 |
MISC |
www.oracle.com |
|
| Pony Mail! |
MISC |
lists.apache.org |
|
| Oracle Critical Patch Update Advisory - January 2022 |
MISC |
www.oracle.com |
|
| Pony Mail! |
MLIST |
lists.apache.org |
|
| lists.apache.org/thread.html/rbefa055282d52d6b58d29a79fbb0be65ab0a38d25f00bd29... |
|
lists.apache.org |
|
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 178738 Debian Security Update for jetty9 (DSA 4949-1)
- 179717 Debian Security Update for jetty9 (CVE-2021-34428)
- 239697 Red Hat Update for OpenShift Container Platform 4.9.0 packages and (RHSA-2021:3758)
- 730265 Eclipse Jetty Multiple Security Vulnerabilities (Bug 573389,574146)
- 770083 Red Hat OpenShift Container Platform 4.9 Security Update (RHSA-2021:3758)
- 770107 Red Hat OpenShift Container Platform 4.9 Security Update (RHSA-2021-3758)
- 980360 Java (maven) Security Update for org.eclipse.jetty:jetty-server (GHSA-m6cp-vxjx-65j6)
