CVE-2021-28164
Fixed in a distro release EPSS 82%CVSS 5.3
In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF directory. For example a request to /context/%2e/WEB-INF/web.xml can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.
Products: The Eclipse Foundation Eclipse Jetty
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.eclipse.jetty:jetty-webapp | 9.4.39 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | jetty9 | 9.4.39-1 |
| Debian 13 | jetty9 | 9.4.39-1 |
| Debian 14 | jetty9 | 9.4.39-1 |
| Red Hat devtools 2021 | rh-eclipse-jetty | 0:9.4.40-1.1.el7_9 |
| Red Hat devtools 2021 | rh-eclipse-jetty-client | 0:9.4.40-1.1.el7_9 |
| Red Hat devtools 2021 | rh-eclipse-jetty-continuation | 0:9.4.40-1.1.el7_9 |
| Red Hat devtools 2021 | rh-eclipse-jetty-http | 0:9.4.40-1.1.el7_9 |
| Red Hat devtools 2021 | rh-eclipse-jetty-io | 0:9.4.40-1.1.el7_9 |
| Red Hat devtools 2021 | rh-eclipse-jetty-jaas | 0:9.4.40-1.1.el7_9 |
| Red Hat devtools 2021 | rh-eclipse-jetty-javadoc | 0:9.4.40-1.1.el7_9 |
| Red Hat devtools 2021 | rh-eclipse-jetty-jmx | 0:9.4.40-1.1.el7_9 |
| Red Hat devtools 2021 | rh-eclipse-jetty-security | 0:9.4.40-1.1.el7_9 |
| Red Hat devtools 2021 | rh-eclipse-jetty-server | 0:9.4.40-1.1.el7_9 |
| Red Hat devtools 2021 | rh-eclipse-jetty-servlet | 0:9.4.40-1.1.el7_9 |
| Red Hat devtools 2021 | rh-eclipse-jetty-util | 0:9.4.40-1.1.el7_9 |
| Red Hat devtools 2021 | rh-eclipse-jetty-util-ajax | 0:9.4.40-1.1.el7_9 |
| Red Hat devtools 2021 | rh-eclipse-jetty-webapp | 0:9.4.40-1.1.el7_9 |
| Red Hat devtools 2021 | rh-eclipse-jetty-xml | 0:9.4.40-1.1.el7_9 |
| SUSE Linux Enterprise Module for Development Tools 15 SP2 | jetty-minimal | 9.4.42-3.9.1 |
| SUSE Linux Enterprise Module for Development Tools 15 SP3 | jetty-minimal | 9.4.42-3.9.1 |
| Ubuntu 18.04 LTS | equinox-bundles | no fix |
| Ubuntu 20.04 LTS | equinox-bundles | no fix |
| Ubuntu 22.04 LTS | equinox-bundles | no fix |
| openSUSE Leap 15.3 | jetty-minimal | 9.4.42-3.9.1 |
| openSUSE Leap 15.3 | jetty-websocket | 9.4.42-3.9.1 |