CVE-2021-34428 - 漏洞详情

CVE-2021-34428 (CNNVD-202106-1589)

LOW

中文标题:

Eclipse Jetty 代码问题漏洞

英文标题:

For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, if an exception is thrown from the Sessi...

CVSS分数: 2.9

发布时间: 2021-06-22 14:45:11

漏洞类型: 代码问题

状态: PUBLISHED

数据质量分数: 0.30

数据版本: v3

漏洞描述

中文描述:

Eclipse Jetty是Eclipse基金会的一个开源的、基于Java的Web服务器和Java Servlet容器。 Eclipse Jetty versions<= 9.4.40存在代码问题漏洞，该漏洞源于SessionListener抛出异常。

英文描述:

For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, if an exception is thrown from the SessionListener#sessionDestroyed() method, then the session ID is not invalidated in the session ID manager. On deployments with clustered sessions and multiple contexts this can result in a session not being invalidated. This can result in an application used on a shared computer being left logged in.

CWE类型:

CWE-613

受影响产品

厂商	产品	版本	版本范围	平台	CPE
The Eclipse Foundation	Eclipse Jetty	-	< unspecified	-	`cpe:2.3:a:the_eclipse_foundation:eclipse_jetty::::::::`
eclipse	jetty	*	-	-	`cpe:2.3:a:eclipse:jetty::::::::`
debian	debian_linux	10.0	-	-	`cpe:2.3:o:debian:debian_linux:10.0:::::::*`
netapp	active_iq_unified_manager	-	-	-	`cpe:2.3:a:netapp:active_iq_unified_manager:-:::::linux::`
netapp	e-series_santricity_os_controller	*	-	-	`cpe:2.3:a:netapp:e-series_santricity_os_controller::::::::`
netapp	e-series_santricity_web_services	-	-	-	`cpe:2.3:a:netapp:e-series_santricity_web_services:-:::::web_services_proxy::`
netapp	element_plug-in_for_vcenter_server	-	-	-	`cpe:2.3:a:netapp:element_plug-in_for_vcenter_server:-:::::::*`
netapp	santricity_cloud_connector	-	-	-	`cpe:2.3:a:netapp:santricity_cloud_connector:-:::::::*`
netapp	snap_creator_framework	-	-	-	`cpe:2.3:a:netapp:snap_creator_framework:-:::::::*`
netapp	snapmanager	-	-	-	`cpe:2.3:a:netapp:snapmanager:-:::::sap::`
oracle	autovue_for_agile_product_lifecycle_management	21.0.2	-	-	`cpe:2.3:a:oracle:autovue_for_agile_product_lifecycle_management:21.0.2:::::::*`
oracle	communications_element_manager	8.2.2	-	-	`cpe:2.3:a:oracle:communications_element_manager:8.2.2:::::::*`
oracle	communications_services_gatekeeper	7.0	-	-	`cpe:2.3:a:oracle:communications_services_gatekeeper:7.0:::::::*`
oracle	communications_session_report_manager	*	-	-	`cpe:2.3:a:oracle:communications_session_report_manager::::::::`
oracle	communications_session_route_manager	*	-	-	`cpe:2.3:a:oracle:communications_session_route_manager::::::::`
oracle	rest_data_services	*	-	-	`cpe:2.3:a:oracle:rest_data_services:::::-:::*`
oracle	siebel_core_-_automation	*	-	-	`cpe:2.3:a:oracle:siebel_core_-_automation::::::::`

解决方案

中文解决方案:

（暂无数据）

英文解决方案:

（暂无数据）

临时解决方案:

（暂无数据）

参考链接

无标题 x_refsource_CONFIRM
cve.org

访问

[kafka-jira] 20210623 [GitHub] [kafka] dongjinleekr opened a new pull request #10919: KAFKA-12985: CVE-2021-28169 - Upgrade jetty to 9.4.41 mailing-list
cve.org

访问

DSA-4949 vendor-advisory
cve.org

访问

[zookeeper-issues] 20210928 [jira] [Updated] (ZOOKEEPER-4390) CVE-2021-28169 , - Upgrade jetty to 9.4.42 mailing-list
cve.org

访问

[zookeeper-issues] 20210928 [jira] [Updated] (ZOOKEEPER-4390) CVE-2021-28169 , CVE-2021-28163, - Upgrade jetty to 9.4.42 mailing-list
cve.org

访问

[zookeeper-issues] 20210928 [jira] [Updated] (ZOOKEEPER-4390) CVE-2021-28169 , CVE-2021-28163, CVE-2021-34428- Upgrade jetty to 9.4.42 mailing-list
cve.org

访问