https://bugzilla.redhat.com/show_bug.cgi?id=1974891
--- Doc Text *updated* by Summer Long <slong(a)redhat.com> ---
A flaw was discovered in the jetty-server, where if an exception is thrown from the
SessionListener#sessionDestroyed() method, then the session ID is not invalidated in the
session ID manager. On deployments with clustered sessions and multiple contexts, this
could result in a session not being invalidated and a shared-computer application being
left logged in. The highest threat from this vulnerability is to data confidentiality and
integrity.
--
You are receiving this mail because:
You are on the CC list for the bug.