CVE-2021-34429
Fixed in a distro release EPSS 99%CVSS 5.3
For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and/or bypass some security constraints. This is a variation of the vulnerability reported in CVE-2021-28164/GHSA-v7ff-8wcx-gmc5.
Products: The Eclipse Foundation Eclipse Jetty
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.eclipse.jetty:jetty-webapp | 9.4.43 |
| Maven | org.eclipse.jetty:jetty-webapp | 10.0.6 |
| Maven | org.eclipse.jetty:jetty-webapp | 11.0.6 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | apache-hop | 2.16.0-r0 |
| Chainguard | apache-hop-fips | 2.16.0-r0 |
| Debian 12 | jetty9 | 9.4.39-3 |
| Debian 13 | jetty9 | 9.4.39-3 |
| Debian 14 | jetty9 | 9.4.39-3 |
| SUSE Linux Enterprise Module for Development Tools 15 SP2 | jetty-minimal | 9.4.43-3.12.2 |
| SUSE Linux Enterprise Module for Development Tools 15 SP3 | jetty-minimal | 9.4.43-3.12.2 |
| Ubuntu 16.04 LTS | jetty9 | no fix |
| Ubuntu 22.04 LTS | jetty9 | no fix |
| openSUSE Leap 15.3 | jetty-minimal | 9.4.43-3.12.2 |
| openSUSE Leap 15.3 | jetty-websocket | 9.4.43-3.12.2 |