CVE-2021-34429

MITRE NVD CVE.ORG Print: PDF PDF

Summary

CVECVE-2021-34429
StatePUBLIC
Assigner[email protected]
Source PriorityCVE Program / NVD first with legacy fallback
Published2021-07-15 17:15:00 UTC
Updated2023-11-07 03:35:00 UTC
DescriptionFor Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and/or bypass some security constraints. This is a variation of the vulnerability reported in CVE-2021-28164/GHSA-v7ff-8wcx-gmc5.

Risk And Classification

Problem Types: NVD-CWE-Other

NVD Known Affected Configurations (CPE 2.3)

TypeVendorProductVersionUpdateEditionLanguage
Application Apache Zookeeper 3.7.0 All All All
Application Apache Zookeeper 3.8.0 All All All
Application Eclipse Jetty All All All All
Application Netapp E-series Santricity Os Controller All All All All
Application Netapp E-series Santricity Web Services - All All All
Application Netapp Element Plug-in For Vcenter Server - All All All
Application Netapp Hci Management Node - All All All
Application Netapp Snapcenter Plug-in - All All All
Application Netapp Snap Creator Framework - All All All
Application Netapp Solidfire - All All All
Application Oracle Autovue For Agile Product Lifecycle Management 21.0.2 All All All
Application Oracle Communications Cloud Native Core Binding Support Function 1.10.0 All All All
Application Oracle Communications Cloud Native Core Security Edge Protection Proxy 1.5.0 All All All
Application Oracle Communications Cloud Native Core Service Communication Proxy 1.14.0 All All All
Application Oracle Communications Cloud Native Core Unified Data Repository 1.14.0 All All All
Application Oracle Communications Diameter Signaling Router All All All All
Application Oracle Financial Services Crime And Compliance Management Studio 8.0.8.2.0 All All All
Application Oracle Financial Services Crime And Compliance Management Studio 8.0.8.3.0 All All All
Application Oracle Rest Data Services All All All All
Application Oracle Retail Eftlink 20.0.1 All All All
Application Oracle Stream Analytics All All All All
Application Oracle Stream Analytics 19c All All All

References

ReferenceSourceLinkTags
Pony Mail! MLIST lists.apache.org
[zookeeper-issues] 20210901 [jira] [Resolved] (ZOOKEEPER-4337) CVE-2021-34429 in jetty 9.4.38.v20210224 in zookeeper 3.7.0 lists.apache.org
[zookeeper-notifications] 20210901 [GitHub] [zookeeper] ztzg closed pull request #1734: ZOOKEEPER-4337: Bump jetty to 9.4.43.v20210629 (avoids CVE-2021-34429) lists.apache.org
Pony Mail! MLIST lists.apache.org
[hbase-issues] 20210921 [jira] [Commented] (HBASE-26292) Update jetty version to fix CVE-2021-34429 lists.apache.org
Pony Mail! MLIST lists.apache.org
Pony Mail! MLIST lists.apache.org
[kafka-commits] 20210817 [kafka] branch 2.7 updated: KAFKA-13209: Upgrade jetty-server to fix CVE-2021-34429 lists.apache.org
Pony Mail! MLIST lists.apache.org
[kafka-commits] 20210817 [kafka] branch 2.8 updated: KAFKA-13209: Upgrade jetty-server to fix CVE-2021-34429 lists.apache.org
Oracle Critical Patch Update Advisory - April 2022 MISC www.oracle.com
Pony Mail! MLIST lists.apache.org
Pony Mail! MLIST lists.apache.org
[zookeeper-notifications] 20210805 [GitHub] [zookeeper] ztzg commented on pull request #1734: ZOOKEEPER-4337: Bump jetty to 9.4.43.v20210629 (avoids CVE-2021-34429) lists.apache.org
Pony Mail! MLIST lists.apache.org
[zookeeper-notifications] 20210827 [GitHub] [zookeeper] nkalmar commented on pull request #1734: ZOOKEEPER-4337: Bump jetty to 9.4.43.v20210629 (avoids CVE-2021-34429) lists.apache.org
Pony Mail! MLIST lists.apache.org
[pulsar-commits] 20210813 [GitHub] [pulsar] eolivelli closed issue #11659: Jetty is flagged with CVE-2021-34429 lists.apache.org
[kafka-jira] 20210817 [GitHub] [kafka] omkreddy merged pull request #11224: KAFKA-13209: Upgrade jetty-server to fix CVE-2021-34429 lists.apache.org
[zookeeper-commits] 20210901 [zookeeper] branch master updated: ZOOKEEPER-4337: Bump jetty to 9.4.43.v20210629 (avoids CVE-2021-34429) lists.apache.org
Pony Mail! MLIST lists.apache.org
Pony Mail! MLIST lists.apache.org
[zookeeper-dev] 20210728 [jira] [Created] (ZOOKEEPER-4337) CVE-2021-34429 in jetty 9.4.38.v20210224 in zookeeper 3.7.0 lists.apache.org
[zookeeper-issues] 20210805 [jira] [Assigned] (ZOOKEEPER-4337) CVE-2021-34429 in jetty 9.4.38.v20210224 in zookeeper 3.7.0 lists.apache.org
Pony Mail! MLIST lists.apache.org
Pony Mail! MLIST lists.apache.org
[zookeeper-issues] 20210728 [jira] [Updated] (ZOOKEEPER-4337) CVE-2021-34429 in jetty 9.4.38.v20210224 in zookeeper 3.7.0 lists.apache.org
Oracle Critical Patch Update Advisory - January 2022 MISC www.oracle.com
Pony Mail! MLIST lists.apache.org
Pony Mail! MLIST lists.apache.org
[kafka-jira] 20210818 [GitHub] [kafka] jolshan opened a new pull request #11224: KAFKA-13209: Upgrade jetty-server to fix CVE-2021-34429 lists.apache.org
Pony Mail! MLIST lists.apache.org
[kafka-jira] 20210817 [jira] [Assigned] (KAFKA-13209) Upgrade jetty-server to fix CVE-2021-34429 lists.apache.org
Pony Mail! MLIST lists.apache.org
[santuario-dev] 20210817 [GitHub] [santuario-xml-security-java] dependabot[bot] opened a new pull request #52: Bump jetty.version from 9.4.42.v20210604 to 9.4.43.v20210629 lists.apache.org
[zookeeper-issues] 20211028 [jira] [Updated] (ZOOKEEPER-4337) CVE-2021-34429 in jetty 9.4.38.v20210224 in zookeeper 3.7.0 lists.apache.org
[pulsar-commits] 20210813 [GitHub] [pulsar] lhotari opened a new pull request #11660: [Security] Upgrade Jetty to 9.4.43.v20210629 lists.apache.org
Pony Mail! MLIST lists.apache.org
[kafka-jira] 20210817 [GitHub] [kafka] jolshan opened a new pull request #11224: KAFKA-13209: Upgrade jetty-server to fix CVE-2021-34429 lists.apache.org
Pony Mail! MLIST lists.apache.org
Pony Mail! MLIST lists.apache.org
Pony Mail! MLIST lists.apache.org
[kafka-dev] 20210817 [jira] [Resolved] (KAFKA-13209) Upgrade jetty-server to fix CVE-2021-34429 lists.apache.org
Pony Mail! MLIST lists.apache.org
[hbase-issues] 20210921 [jira] [Created] (HBASE-26292) Update jetty version to fix CVE-2021-34429 lists.apache.org
[kafka-jira] 20210817 [jira] [Updated] (KAFKA-13209) Upgrade jetty-server to fix CVE-2021-34429 lists.apache.org
[hbase-dev] 20210921 [jira] [Created] (HBASE-26292) Update jetty version to fix CVE-2021-34429 lists.apache.org
Pony Mail! MLIST lists.apache.org
[zookeeper-issues] 20210728 [jira] [Created] (ZOOKEEPER-4337) CVE-2021-34429 in jetty 9.4.38.v20210224 in zookeeper 3.7.0 lists.apache.org
[kafka-jira] 20210817 [jira] [Resolved] (KAFKA-13209) Upgrade jetty-server to fix CVE-2021-34429 lists.apache.org
Pony Mail! MLIST lists.apache.org
[zookeeper-issues] 20210805 [jira] [Updated] (ZOOKEEPER-4337) CVE-2021-34429 in jetty 9.4.38.v20210224 in zookeeper 3.7.0 lists.apache.org
[zookeeper-notifications] 20210825 [GitHub] [zookeeper] ztzg commented on pull request #1734: ZOOKEEPER-4337: Bump jetty to 9.4.43.v20210629 (avoids CVE-2021-34429) lists.apache.org
[zookeeper-commits] 20210901 [zookeeper] branch branch-3.7 updated: ZOOKEEPER-4337: Bump jetty to 9.4.43.v20210629 (avoids CVE-2021-34429) lists.apache.org
github.com/eclipse/jetty.project/security/advisories/GHSA-vjv5-gp2w-65vm CONFIRM github.com
Pony Mail! MLIST lists.apache.org
Pony Mail! MLIST lists.apache.org
[zookeeper-notifications] 20210805 [GitHub] [zookeeper] ztzg opened a new pull request #1734: ZOOKEEPER-4337: Bump jetty to 9.4.43.v20210629 (avoids CVE-2021-34429) lists.apache.org
Pony Mail! MLIST lists.apache.org
CVE-2021-34429 Eclipse Jetty Vulnerability in NetApp Products | NetApp Product Security CONFIRM security.netapp.com
Pony Mail! MLIST lists.apache.org
Pony Mail! MLIST lists.apache.org
[pulsar-commits] 20210813 [GitHub] [pulsar] eolivelli opened a new issue #11659: Jetty is flagged with CVE-2021-34429 lists.apache.org
[kafka-commits] 20210817 [kafka] branch 3.0 updated: KAFKA-13209: Upgrade jetty-server to fix CVE-2021-34429 lists.apache.org
Oracle Critical Patch Update Advisory - July 2022 N/A www.oracle.com
[kafka-jira] 20210818 [GitHub] [kafka] omkreddy merged pull request #11224: KAFKA-13209: Upgrade jetty-server to fix CVE-2021-34429 lists.apache.org
Pony Mail! MLIST lists.apache.org
[zookeeper-notifications] 20210825 [GitHub] [zookeeper] eolivelli commented on pull request #1734: ZOOKEEPER-4337: Bump jetty to 9.4.43.v20210629 (avoids CVE-2021-34429) lists.apache.org
Pony Mail! MLIST lists.apache.org
Pony Mail! MLIST lists.apache.org
Pony Mail! MLIST lists.apache.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

Legacy QID Mappings

  • 179626 Debian Security Update for jetty9 (CVE-2021-34429)
  • 751047 OpenSUSE Security Update for jetty-minimal (openSUSE-SU-2021:2838-1)
  • 980212 Java (maven) Security Update for org.eclipse.jetty:jetty-webapp (GHSA-vjv5-gp2w-65vm)
© CVE.report 2026 |

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

CVE.report and Source URL Uptime Status status.cve.report