CVE-2021-34428
Fixed in a distro release EPSS <1%CVSS 2.9
For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, if an exception is thrown from the SessionListener#sessionDestroyed() method, then the session ID is not invalidated in the session ID manager. On deployments with clustered sessions and multiple contexts this can result in a session not being invalidated. This can result in an application used on a shared computer being left logged in.
Products: The Eclipse Foundation Eclipse Jetty
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.eclipse.jetty:jetty-server | 9.4.41 |
| Maven | org.eclipse.jetty:jetty-server | 10.0.3 |
| Maven | org.eclipse.jetty:jetty-server | 11.0.3 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | hadoop-fips-3.3.6 | no fix |
| Chainguard | hadoop-fips-3.4.2 | no fix |
| Chainguard | hadoop-fips-3.5 | no fix |
| Debian 10 | jetty9 | 9.4.16-0+deb10u1 |
| Debian 12 | jetty9 | 9.4.39-2 |
| Debian 13 | jetty9 | 9.4.39-2 |
| Debian 14 | jetty9 | 9.4.39-2 |
| Red Hat openshift 4.9 | coreos-installer | 0:0.10.0-2.rhaos4.9.el8 |
| Red Hat openshift 4.9 | coreos-installer-bootinfra | 0:0.10.0-2.rhaos4.9.el8 |
| Red Hat openshift 4.9 | coreos-installer-bootinfra-debuginfo | 0:0.10.0-2.rhaos4.9.el8 |
| Red Hat openshift 4.9 | coreos-installer-debuginfo | 0:0.10.0-2.rhaos4.9.el8 |
| Red Hat openshift 4.9 | coreos-installer-debugsource | 0:0.10.0-2.rhaos4.9.el8 |
| Red Hat openshift 4.9 | jenkins | 0:2.289.3.1630554997-1.el8 |
| Red Hat openshift 4.9 | network-scripts-openvswitch2.15 | 0:2.15.0-28.el8fdp |
| Red Hat openshift 4.9 | openshift | 0:4.9.0-202110080828.p0.git.894a78b.assembly.stream.el7 |
| Red Hat openshift 4.9 | openshift | 0:4.9.0-202110080828.p0.git.894a78b.assembly.stream.el8 |
| Red Hat openshift 4.9 | openshift-hyperkube | 0:4.9.0-202110080828.p0.git.894a78b.assembly.stream.el8 |
| Red Hat openshift 4.9 | openshift-hyperkube | 0:4.9.0-202110080828.p0.git.894a78b.assembly.stream.el7 |
| Red Hat openshift 4.9 | openvswitch2.15 | 0:2.15.0-28.el8fdp |
| Red Hat openshift 4.9 | openvswitch2.15-debuginfo | 0:2.15.0-28.el8fdp |
| Red Hat openshift 4.9 | openvswitch2.15-debugsource | 0:2.15.0-28.el8fdp |
| Red Hat openshift 4.9 | openvswitch2.15-devel | 0:2.15.0-28.el8fdp |
| Red Hat openshift 4.9 | openvswitch2.15-ipsec | 0:2.15.0-28.el8fdp |
| Red Hat openshift 4.9 | openvswitch2.15-test | 0:2.15.0-28.el8fdp |
| Red Hat openshift 4.9 | python3-openvswitch2.15 | 0:2.15.0-28.el8fdp |
| Red Hat openshift 4.9 | python3-openvswitch2.15-debuginfo | 0:2.15.0-28.el8fdp |
| Ubuntu 14.04 LTS | jetty | no fix |
| Ubuntu 14.04 LTS | jetty8 | no fix |
| Ubuntu 16.04 LTS | jetty | no fix |
| Ubuntu 16.04 LTS | jetty8 | no fix |
| Ubuntu 16.04 LTS | jetty9 | no fix |
| Ubuntu 18.04 LTS | jetty9 | no fix |
| Ubuntu 20.04 LTS | jetty9 | no fix |