CVE-2021-28163
Fixed in a distro release EPSS 4%CVSS 2.7
In Eclipse Jetty 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to 11.0.1, if a user uses a webapps directory that is a symlink, the contents of the webapps directory is deployed as a static webapp, inadvertently serving the webapps themselves and anything else that might be in that directory.
Products: The Eclipse Foundation Eclipse Jetty
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.eclipse.jetty:jetty-deploy | 9.4.39 |
| Maven | org.eclipse.jetty:jetty-deploy | 10.0.2 |
| Maven | org.eclipse.jetty:jetty-deploy | 11.0.2 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | jetty9 | 9.4.39-1 |
| Debian 13 | jetty9 | 9.4.39-1 |
| Debian 14 | jetty9 | 9.4.39-1 |
| Red Hat devtools 2021 | rh-eclipse-jetty | 0:9.4.40-1.1.el7_9 |
| Red Hat devtools 2021 | rh-eclipse-jetty-client | 0:9.4.40-1.1.el7_9 |
| Red Hat devtools 2021 | rh-eclipse-jetty-continuation | 0:9.4.40-1.1.el7_9 |
| Red Hat devtools 2021 | rh-eclipse-jetty-http | 0:9.4.40-1.1.el7_9 |
| Red Hat devtools 2021 | rh-eclipse-jetty-io | 0:9.4.40-1.1.el7_9 |
| Red Hat devtools 2021 | rh-eclipse-jetty-jaas | 0:9.4.40-1.1.el7_9 |
| Red Hat devtools 2021 | rh-eclipse-jetty-javadoc | 0:9.4.40-1.1.el7_9 |
| Red Hat devtools 2021 | rh-eclipse-jetty-jmx | 0:9.4.40-1.1.el7_9 |
| Red Hat devtools 2021 | rh-eclipse-jetty-security | 0:9.4.40-1.1.el7_9 |
| Red Hat devtools 2021 | rh-eclipse-jetty-server | 0:9.4.40-1.1.el7_9 |
| Red Hat devtools 2021 | rh-eclipse-jetty-servlet | 0:9.4.40-1.1.el7_9 |
| Red Hat devtools 2021 | rh-eclipse-jetty-util | 0:9.4.40-1.1.el7_9 |
| Red Hat devtools 2021 | rh-eclipse-jetty-util-ajax | 0:9.4.40-1.1.el7_9 |
| Red Hat devtools 2021 | rh-eclipse-jetty-webapp | 0:9.4.40-1.1.el7_9 |
| Red Hat devtools 2021 | rh-eclipse-jetty-xml | 0:9.4.40-1.1.el7_9 |
| Red Hat openshift 4.7 | cri-tools | 0:1.20.0-2.el7 |
| Red Hat openshift 4.7 | cri-tools | 0:1.20.0-2.el8 |
| Red Hat openshift 4.7 | cri-tools-debuginfo | 0:1.20.0-2.el8 |
| Red Hat openshift 4.7 | cri-tools-debuginfo | 0:1.20.0-2.el7 |
| Red Hat openshift 4.7 | cri-tools-debugsource | 0:1.20.0-2.el8 |
| Red Hat openshift 4.7 | jenkins | 0:2.277.3.1620393611-1.el8 |
| Red Hat openshift 4.7 | runc | 0:1.0.0-95.rhaos4.8.gitcd80260.el8 |
| Red Hat openshift 4.7 | runc | 0:1.0.0-95.rhaos4.8.gitcd80260.el7 |
| Red Hat openshift 4.7 | runc-debuginfo | 0:1.0.0-95.rhaos4.8.gitcd80260.el7 |
| Red Hat openshift 4.7 | runc-debuginfo | 0:1.0.0-95.rhaos4.8.gitcd80260.el8 |
| Red Hat openshift 4.7 | runc-debugsource | 0:1.0.0-95.rhaos4.8.gitcd80260.el8 |
| SUSE Linux Enterprise Module for Development Tools 15 SP2 | jetty-minimal | 9.4.42-3.9.1 |
| SUSE Linux Enterprise Module for Development Tools 15 SP3 | jetty-minimal | 9.4.42-3.9.1 |
| Ubuntu 18.04 LTS | equinox-bundles | no fix |
| Ubuntu 20.04 LTS | equinox-bundles | no fix |
| Ubuntu 22.04 LTS | equinox-bundles | no fix |
| openSUSE Leap 15.3 | jetty-minimal | 9.4.42-3.9.1 |
| openSUSE Leap 15.3 | jetty-websocket | 9.4.42-3.9.1 |