CVE-2021-34428: Low severity Eclipse Jetty vulnerability
A flaw was discovered in the jetty-server, where if an exception is thrown from the SessionListener#sessionDestroyed() method, then the session ID is not invalidated in the session ID manager. On deployments with clustered sessions and multiple contexts, this could result in a session not being invalidated and a shared-computer application being left logged in. The highest threat from this vulnerability is to data confidentiality and integrity.
Other sources
For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, if an exception is thrown from the SessionListener#sessionDestroyed() method, then the session ID is not invalidated in the session ID manager. On deployments with clustered sessions and multiple contexts this can result in a session not being invalidated. This can result in an application used on a shared computer being left logged in.
For Eclipse Jetty versions = 9.4.40, = 10.0.2, = 11.0.2, if an exception is thrown from the SessionListener#sessionDestroyed() method, then the session ID is not invalidated in the session ID manager. On deployments with clustered sessions and multiple contexts this can result in a session not being invalidated. This can result in an application used on a shared computer being left logged in.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/jenkinsto a version that resolves this vulnerability.Fixed in 0:2.289.3.1630554997-1.el8 - Upgrade
Upgrade
debian/jetty9to a version that resolves this vulnerability.Fixed in 9.4.16-0+deb10u1Fixed in 9.4.50-4+deb10u1Fixed in 9.4.39-3+deb11u2Fixed in 9.4.50-4+deb11u1Fixed in 9.4.50-4+deb12u2Fixed in 9.4.53-1 - Upgrade
Upgrade
redhat/jettyto a version that resolves this vulnerability.Fixed in 9.4.41 - Upgrade
Upgrade
redhat/jettyto a version that resolves this vulnerability.Fixed in 10.0.3 - Upgrade
Upgrade
redhat/jettyto a version that resolves this vulnerability.Fixed in 11.0.3 - Upgrade
Upgrade
debian/jetty9to a version that resolves this vulnerability.Fixed in 9.4.16-0+deb10u1 - Upgrade
Upgrade
debian/jetty9to a version that resolves this vulnerability.Fixed in 9.4.50-4+deb10u1 - Upgrade
Upgrade
debian/jetty9to a version that resolves this vulnerability.Fixed in 9.4.39-3+deb11u2 - Upgrade
Upgrade
debian/jetty9to a version that resolves this vulnerability.Fixed in 9.4.50-4+deb11u1 - Upgrade
Upgrade
debian/jetty9to a version that resolves this vulnerability.Fixed in 9.4.50-4+deb12u2 - Upgrade
Upgrade
debian/jetty9to a version that resolves this vulnerability.Fixed in 9.4.53-1 - Configuration
Modify SessionListener#sessionDestroyed() implementations in application code to catch all Throwables so exceptions do not prevent session IDs being invalidated.
Application SessionListener#sessionDestroyed() exception_handling = catch all Throwables
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2021-34428?
CVE-2021-34428 is a vulnerability in Eclipse Jetty that allows a physical attacker to bypass security restrictions caused by a session ID.
How severe is CVE-2021-34428?
CVE-2021-34428 has a severity rating of low, with a severity value of 3.5.
What is the affected software?
The affected software includes Eclipse Jetty versions up to 9.4.41, 10.0.3, and 11.0.3. It also affects Debian Jetty9 versions 9.4.16-0+deb10u1, 9.4.16-0+deb10u3, 9.4.39-3+deb11u2, 9.4.50-4+deb12u1, and 9.4.53-1.
How can I fix CVE-2021-34428?
To fix CVE-2021-34428, upgrade Eclipse Jetty to version 9.4.41, 10.0.3, or 11.0.3. If you're using Debian Jetty9, upgrade to one of the patched versions mentioned in the affected software list.
Where can I find more information about CVE-2021-34428?
You can find more information about CVE-2021-34428 in the references provided, including the GitHub security advisory, Red Hat Bugzilla report, and Red Hat support policy.