CVE-2021-28169
Fixed in a distro release EPSS 78%CVSS 5.3
For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory. For example a request to `/concat?/%2557EB-INF/web.xml` can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.
Products: The Eclipse Foundation Eclipse Jetty
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.eclipse.jetty:jetty-servlets | 9.4.41 |
| Maven | org.eclipse.jetty:jetty-servlets | 10.0.3 |
| Maven | org.eclipse.jetty:jetty-servlets | 11.0.3 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux 2 | jetty-annotations | 9.0.3-8.amzn2.0.1 |
| Amazon Linux 2 | jetty-ant | 9.0.3-8.amzn2.0.1 |
| Amazon Linux 2 | jetty-client | 9.0.3-8.amzn2.0.1 |
| Amazon Linux 2 | jetty-continuation | 9.0.3-8.amzn2.0.1 |
| Amazon Linux 2 | jetty-deploy | 9.0.3-8.amzn2.0.1 |
| Amazon Linux 2 | jetty-http | 9.0.3-8.amzn2.0.1 |
| Amazon Linux 2 | jetty-io | 9.0.3-8.amzn2.0.1 |
| Amazon Linux 2 | jetty-jaas | 9.0.3-8.amzn2.0.1 |
| Amazon Linux 2 | jetty-jaspi | 9.0.3-8.amzn2.0.1 |
| Amazon Linux 2 | jetty-javadoc | 9.0.3-8.amzn2.0.1 |
| Amazon Linux 2 | jetty-jmx | 9.0.3-8.amzn2.0.1 |
| Amazon Linux 2 | jetty-jndi | 9.0.3-8.amzn2.0.1 |
| Amazon Linux 2 | jetty-jsp | 9.0.3-8.amzn2.0.1 |
| Amazon Linux 2 | jetty-jspc-maven-plugin | 9.0.3-8.amzn2.0.1 |
| Amazon Linux 2 | jetty-maven-plugin | 9.0.3-8.amzn2.0.1 |
| Amazon Linux 2 | jetty-monitor | 9.0.3-8.amzn2.0.1 |
| Amazon Linux 2 | jetty-plus | 9.0.3-8.amzn2.0.1 |
| Amazon Linux 2 | jetty-project | 9.0.3-8.amzn2.0.1 |
| Amazon Linux 2 | jetty-proxy | 9.0.3-8.amzn2.0.1 |
| Amazon Linux 2 | jetty-rewrite | 9.0.3-8.amzn2.0.1 |
| Amazon Linux 2 | jetty-runner | 9.0.3-8.amzn2.0.1 |
| Amazon Linux 2 | jetty-security | 9.0.3-8.amzn2.0.1 |
| Amazon Linux 2 | jetty-server | 9.0.3-8.amzn2.0.1 |
| Amazon Linux 2 | jetty-servlet | 9.0.3-8.amzn2.0.1 |
| Amazon Linux 2 | jetty-servlets | 9.0.3-8.amzn2.0.1 |
| Amazon Linux 2 | jetty-start | 9.0.3-8.amzn2.0.1 |
| Amazon Linux 2 | jetty-util | 9.0.3-8.amzn2.0.1 |
| Amazon Linux 2 | jetty-util-ajax | 9.0.3-8.amzn2.0.1 |
| Amazon Linux 2 | jetty-webapp | 9.0.3-8.amzn2.0.1 |
| Amazon Linux 2 | jetty-websocket-api | 9.0.3-8.amzn2.0.1 |
| Amazon Linux 2 | jetty-websocket-client | 9.0.3-8.amzn2.0.1 |
| Amazon Linux 2 | jetty-websocket-common | 9.0.3-8.amzn2.0.1 |
| Amazon Linux 2 | jetty-websocket-parent | 9.0.3-8.amzn2.0.1 |
| Amazon Linux 2 | jetty-websocket-server | 9.0.3-8.amzn2.0.1 |
| Amazon Linux 2 | jetty-websocket-servlet | 9.0.3-8.amzn2.0.1 |
| Amazon Linux 2 | jetty-xml | 9.0.3-8.amzn2.0.1 |
| Chainguard | hadoop-fips-3.3.6 | no fix |
| Chainguard | hadoop-fips-3.4.2 | no fix |
| Chainguard | hadoop-fips-3.5 | no fix |
| Debian 10 | jetty9 | 9.4.16-0+deb10u1 |
| Debian 12 | jetty9 | 9.4.39-2 |
| Debian 13 | jetty9 | 9.4.39-2 |
| Debian 14 | jetty9 | 9.4.39-2 |
| Debian 9 | jetty9 | 9.2.30-0+deb9u2 |
| Red Hat openshift 4.9 | coreos-installer | 0:0.10.0-2.rhaos4.9.el8 |
| Red Hat openshift 4.9 | coreos-installer-bootinfra | 0:0.10.0-2.rhaos4.9.el8 |
| Red Hat openshift 4.9 | coreos-installer-bootinfra-debuginfo | 0:0.10.0-2.rhaos4.9.el8 |
| Red Hat openshift 4.9 | coreos-installer-debuginfo | 0:0.10.0-2.rhaos4.9.el8 |
| Red Hat openshift 4.9 | coreos-installer-debugsource | 0:0.10.0-2.rhaos4.9.el8 |
| Red Hat openshift 4.9 | jenkins | 0:2.289.3.1630554997-1.el8 |
| Red Hat openshift 4.9 | network-scripts-openvswitch2.15 | 0:2.15.0-28.el8fdp |
| Red Hat openshift 4.9 | openshift | 0:4.9.0-202110080828.p0.git.894a78b.assembly.stream.el8 |
| Red Hat openshift 4.9 | openshift | 0:4.9.0-202110080828.p0.git.894a78b.assembly.stream.el7 |
| Red Hat openshift 4.9 | openshift-hyperkube | 0:4.9.0-202110080828.p0.git.894a78b.assembly.stream.el8 |
| Red Hat openshift 4.9 | openshift-hyperkube | 0:4.9.0-202110080828.p0.git.894a78b.assembly.stream.el7 |
| Red Hat openshift 4.9 | openvswitch2.15 | 0:2.15.0-28.el8fdp |
| Red Hat openshift 4.9 | openvswitch2.15-debuginfo | 0:2.15.0-28.el8fdp |
| Red Hat openshift 4.9 | openvswitch2.15-debugsource | 0:2.15.0-28.el8fdp |
| Red Hat openshift 4.9 | openvswitch2.15-devel | 0:2.15.0-28.el8fdp |
| Red Hat openshift 4.9 | openvswitch2.15-ipsec | 0:2.15.0-28.el8fdp |
| Red Hat openshift 4.9 | openvswitch2.15-test | 0:2.15.0-28.el8fdp |
| Red Hat openshift 4.9 | python3-openvswitch2.15 | 0:2.15.0-28.el8fdp |
| Red Hat openshift 4.9 | python3-openvswitch2.15-debuginfo | 0:2.15.0-28.el8fdp |
| SUSE Linux Enterprise Module for Development Tools 15 SP2 | jetty-minimal | 9.4.42-3.9.1 |
| SUSE Linux Enterprise Module for Development Tools 15 SP3 | jetty-minimal | 9.4.42-3.9.1 |
| Ubuntu 14.04 LTS | jetty | no fix |
| Ubuntu 14.04 LTS | jetty8 | no fix |
| Ubuntu 16.04 LTS | jetty | no fix |
| Ubuntu 16.04 LTS | jetty8 | no fix |
| Ubuntu 16.04 LTS | jetty9 | no fix |
| Ubuntu 18.04 LTS | jetty9 | no fix |
| Ubuntu 20.04 LTS | jetty9 | no fix |
| openSUSE Leap 15.3 | jetty-minimal | 9.4.42-3.9.1 |
| openSUSE Leap 15.3 | jetty-websocket | 9.4.42-3.9.1 |