CVE-2021-34428: Low severity IBM Cognos Analytics vulnerability
A flaw was discovered in the jetty-server, where if an exception is thrown from the SessionListener#sessionDestroyed() method, then the session ID is not invalidated in the session ID manager. On deployments with clustered sessions and multiple contexts, this could result in a session not being invalidated and a shared-computer application being left logged in. The highest threat from this vulnerability is to data confidentiality and integrity.
Other sources
Eclipse Jetty could allow a physical attacker to bypass security restrictions, caused by a session ID is not invalidated flaw when an exception is thrown from the SessionListener#sessionDestroyed() method. By gaining access to the application on the shared computer, an attacker could exploit this vulnerability to bypass access restrictions.
— IBM
For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, if an exception is thrown from the SessionListener#sessionDestroyed() method, then the session ID is not invalidated in the session ID manager. On deployments with clustered sessions and multiple contexts this can result in a session not being invalidated. This can result in an application used on a shared computer being left logged in.
Affected Software
Remediation
Patch Available
Patch Available
Information
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2021-34428?
CVE-2021-34428 is a vulnerability in Eclipse Jetty that allows a physical attacker to bypass security restrictions caused by a session ID.
How severe is CVE-2021-34428?
CVE-2021-34428 has a severity rating of low, with a severity value of 3.5.
What is the affected software?
The affected software includes Eclipse Jetty versions up to 9.4.41, 10.0.3, and 11.0.3. It also affects Debian Jetty9 versions 9.4.16-0+deb10u1, 9.4.16-0+deb10u3, 9.4.39-3+deb11u2, 9.4.50-4+deb12u1, and 9.4.53-1.
How can I fix CVE-2021-34428?
To fix CVE-2021-34428, upgrade Eclipse Jetty to version 9.4.41, 10.0.3, or 11.0.3. If you're using Debian Jetty9, upgrade to one of the patched versions mentioned in the affected software list.
Where can I find more information about CVE-2021-34428?
You can find more information about CVE-2021-34428 in the references provided, including the GitHub security advisory, Red Hat Bugzilla report, and Red Hat support policy.