[Bug 1974891] New: CVE-2021-34428 jetty: SessionListener can prevent a session from being invalidated breaking logout

List overview All Threads
Download

newer

older

[Bug 1985225] New: CVE-2021-34429...

[Bug 1974892] New: CVE-2021-34428...

bugzilla＠redhat.com

22 Jun 2021 22 Jun '21

8:52 p.m.

https://bugzilla.redhat.com/show_bug.cgi?id=1974891

Bug ID: 1974891 Summary: CVE-2021-34428 jetty: SessionListener can prevent a session from being invalidated breaking logout Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: low Priority: low Assignee: security-response-team@redhat.com Reporter: gsuckevi@redhat.com CC: abenaiss@redhat.com, aileenc@redhat.com, aos-bugs@redhat.com, ataylor@redhat.com, bibryam@redhat.com, bmontgom@redhat.com, chazlett@redhat.com, dbecker@redhat.com, drieden@redhat.com, eclipse-sig@lists.fedoraproject.org, eparis@redhat.com, eric.wittmann@redhat.com, ggaughan@redhat.com, gmalinko@redhat.com, hbraun@redhat.com, janstey@redhat.com, java-sig-commits@lists.fedoraproject.org, jburrell@redhat.com, jjohnstn@redhat.com, jjoyce@redhat.com, jkang@redhat.com, jnethert@redhat.com, jochrist@redhat.com, jokerman@redhat.com, jross@redhat.com, jschluet@redhat.com, jwon@redhat.com, krzysztof.daniel@gmail.com, lhh@redhat.com, lpeer@redhat.com, mat.booth@gmail.com, mburns@redhat.com, mizdebsk@redhat.com, mkolesni@redhat.com, nstielau@redhat.com, pantinor@redhat.com, pbhattac@redhat.com, sclewis@redhat.com, scohen@redhat.com, sd-operator-metering@redhat.com, slinaber@redhat.com, sochotni@redhat.com, sponnaga@redhat.com, swoodman@redhat.com, tflannag@redhat.com, vbobade@redhat.com Target Milestone: --- Classification: Other

For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, if an exception is thrown from the SessionListener#sessionDestroyed() method, then the session ID is not invalidated in the session ID manager. On deployments with clustered sessions and multiple contexts this can result in a session not being invalidated. This can result in an application used on a shared computer being left logged in.

Reference: https://github.com/eclipse/jetty.project/security/advisories/GHSA-m6cp-vxjx-...

-- You are receiving this mail because: You are on the CC list for the bug.

Show replies by date

bugzilla＠redhat.com

22 Jun 22 Jun

8:52 p.m.

New subject: [Bug 1974891] CVE-2021-34428 jetty: SessionListener can prevent a session from being invalidated breaking logout

https://bugzilla.redhat.com/show_bug.cgi?id=1974891

Guilherme de Almeida Suckevicz gsuckevi@redhat.com changed:

Referenced Bugs:

https://bugzilla.redhat.com/show_bug.cgi?id=1974892 [Bug 1974892] CVE-2021-34428 jetty: SessionListener can prevent a session from being invalidated breaking logout [fedora-all]

-- You are receiving this mail because: You are on the CC list for the bug.

bugzilla＠redhat.com

8:53 p.m.

New subject: [Bug 1974891] CVE-2021-34428 jetty: SessionListener can prevent a session from being invalidated breaking logout

https://bugzilla.redhat.com/show_bug.cgi?id=1974891

--- Comment #1 from Guilherme de Almeida Suckevicz gsuckevi@redhat.com --- Created jetty tracking bugs for this issue:

Affects: fedora-all [bug 1974892]

-- You are receiving this mail because: You are on the CC list for the bug.

bugzilla＠redhat.com

28 Jun 28 Jun

6:12 a.m.

New subject: [Bug 1974891] CVE-2021-34428 jetty: SessionListener can prevent a session from being invalidated breaking logout

https://bugzilla.redhat.com/show_bug.cgi?id=1974891

Summer Long slong@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug.

bugzilla＠redhat.com

6:52 a.m.

New subject: [Bug 1974891] CVE-2021-34428 jetty: SessionListener can prevent a session from being invalidated breaking logout

https://bugzilla.redhat.com/show_bug.cgi?id=1974891

--- Doc Text *updated* by Summer Long slong@redhat.com --- A flaw was discovered in the jetty-server, where if an exception is thrown from the SessionListener#sessionDestroyed() method, then the session ID is not invalidated in the session ID manager. On deployments with clustered sessions and multiple contexts, this could result in a session not being invalidated and a shared-computer application being left logged in.

-- You are receiving this mail because: You are on the CC list for the bug.

bugzilla＠redhat.com

6:53 a.m.

New subject: [Bug 1974891] CVE-2021-34428 jetty: SessionListener can prevent a session from being invalidated breaking logout

https://bugzilla.redhat.com/show_bug.cgi?id=1974891

-- You are receiving this mail because: You are on the CC list for the bug.

bugzilla＠redhat.com

30 Jun 30 Jun

12:59 p.m.

New subject: [Bug 1974891] CVE-2021-34428 jetty: SessionListener can prevent a session from being invalidated breaking logout

https://bugzilla.redhat.com/show_bug.cgi?id=1974891

Paramvir jindal pjindal@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug.

bugzilla＠redhat.com

3:16 p.m.

New subject: [Bug 1974891] CVE-2021-34428 jetty: SessionListener can prevent a session from being invalidated breaking logout

https://bugzilla.redhat.com/show_bug.cgi?id=1974891

--- Comment #3 from Jonathan Christison jochrist@redhat.com --- This vulnerability is out of security support scope for the following products:

* Red Hat JBoss Fuse 6 * Red Hat JBoss A-MQ 6

Please refer to https://access.redhat.com/support/policy/updates/jboss_notes for more details.

-- You are receiving this mail because: You are on the CC list for the bug.

bugzilla＠redhat.com

3:28 p.m.

New subject: [Bug 1974891] CVE-2021-34428 jetty: SessionListener can prevent a session from being invalidated breaking logout

https://bugzilla.redhat.com/show_bug.cgi?id=1974891

--- Comment #4 from Jonathan Christison jochrist@redhat.com --- Upstream Fixing commit: https://github.com/eclipse/jetty.project/commit/087f486b4461746b4ded45833887...

-- You are receiving this mail because: You are on the CC list for the bug.

bugzilla＠redhat.com

3:39 p.m.

New subject: [Bug 1974891] CVE-2021-34428 jetty: SessionListener can prevent a session from being invalidated breaking logout

https://bugzilla.redhat.com/show_bug.cgi?id=1974891

--- Comment #5 from Jonathan Christison jochrist@redhat.com --- Explicitly Marking Red Hat Camel K and Camel Quarkus as having a low impact, although Camel K distributes jetty artifacts through camel-jetty, camel-jetty itself is not available for use by the application developer, http functionality is provided by the camel-k default runtime, Quarkus.

Explicitly Marking Red Hat Integration Red Hat Integration Service Registry as having a low impact, although Service Registry distributes Jetty as part of Kafka Connect component it is not available in the productised release, meaning jetty is also not available for use by the end application developer.

-- You are receiving this mail because: You are on the CC list for the bug.

bugzilla＠redhat.com

1 Jul 1 Jul

6:36 p.m.

New subject: [Bug 1974891] CVE-2021-34428 jetty: SessionListener can prevent a session from being invalidated breaking logout

https://bugzilla.redhat.com/show_bug.cgi?id=1974891

Przemyslaw Roguski proguski@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug.

bugzilla＠redhat.com

6:36 p.m.

New subject: [Bug 1974891] CVE-2021-34428 jetty: SessionListener can prevent a session from being invalidated breaking logout

https://bugzilla.redhat.com/show_bug.cgi?id=1974891

Przemyslaw Roguski proguski@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug.

bugzilla＠redhat.com

4 Jul 4 Jul

3:19 p.m.

New subject: [Bug 1974891] CVE-2021-34428 jetty: SessionListener can prevent a session from being invalidated breaking logout

https://bugzilla.redhat.com/show_bug.cgi?id=1974891

lnacshon@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1979036

-- You are receiving this mail because: You are on the CC list for the bug.

bugzilla＠redhat.com

13 Jul 13 Jul

5:40 a.m.

New subject: [Bug 1974891] CVE-2021-34428 jetty: SessionListener can prevent a session from being invalidated breaking logout

https://bugzilla.redhat.com/show_bug.cgi?id=1974891

Doran Moppert dmoppert@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1981630, 1981629

-- You are receiving this mail because: You are on the CC list for the bug.

bugzilla＠redhat.com

19 Aug 19 Aug

10:18 a.m.

New subject: [Bug 1974891] CVE-2021-34428 jetty: SessionListener can prevent a session from being invalidated breaking logout

https://bugzilla.redhat.com/show_bug.cgi?id=1974891

--- Comment #12 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:

Red Hat AMQ Streams 1.8.0

Via RHSA-2021:3225 https://access.redhat.com/errata/RHSA-2021:3225

-- You are receiving this mail because: You are on the CC list for the bug.

bugzilla＠redhat.com

10:18 a.m.

New subject: [Bug 1974891] CVE-2021-34428 jetty: SessionListener can prevent a session from being invalidated breaking logout

https://bugzilla.redhat.com/show_bug.cgi?id=1974891

errata-xmlrpc errata-xmlrpc@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug.

bugzilla＠redhat.com

12:35 p.m.

New subject: [Bug 1974891] CVE-2021-34428 jetty: SessionListener can prevent a session from being invalidated breaking logout

https://bugzilla.redhat.com/show_bug.cgi?id=1974891

Product Security DevOps Team prodsec-dev@redhat.com changed:

--- Comment #13 from Product Security DevOps Team prodsec-dev@redhat.com --- This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-34428

-- You are receiving this mail because: You are on the CC list for the bug.

bugzilla＠redhat.com

21 Sep 21 Sep

3:59 p.m.

New subject: [Bug 1974891] CVE-2021-34428 jetty: SessionListener can prevent a session from being invalidated breaking logout

https://bugzilla.redhat.com/show_bug.cgi?id=1974891

jawed jkhelil@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1972361

Referenced Bugs:

https://bugzilla.redhat.com/show_bug.cgi?id=1972361 [Bug 1972361] Bump jenkins version to 2.289.1

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=1974891

bugzilla＠redhat.com

30 Sep 30 Sep

12:58 p.m.

New subject: [Bug 1974891] CVE-2021-34428 jetty: SessionListener can prevent a session from being invalidated breaking logout

https://bugzilla.redhat.com/show_bug.cgi?id=1974891

--- Comment #14 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:

Red Hat AMQ 7.9.0

Via RHSA-2021:3700 https://access.redhat.com/errata/RHSA-2021:3700

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=1974891

bugzilla＠redhat.com

12:58 p.m.

New subject: [Bug 1974891] CVE-2021-34428 jetty: SessionListener can prevent a session from being invalidated breaking logout

https://bugzilla.redhat.com/show_bug.cgi?id=1974891

errata-xmlrpc errata-xmlrpc@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=1974891

bugzilla＠redhat.com

18 Oct 18 Oct

7:51 p.m.

New subject: [Bug 1974891] CVE-2021-34428 jetty: SessionListener can prevent a session from being invalidated breaking logout

https://bugzilla.redhat.com/show_bug.cgi?id=1974891

--- Comment #15 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:

Red Hat OpenShift Container Platform 4.9

Via RHSA-2021:3758 https://access.redhat.com/errata/RHSA-2021:3758

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=1974891

bugzilla＠redhat.com

7:51 p.m.

New subject: [Bug 1974891] CVE-2021-34428 jetty: SessionListener can prevent a session from being invalidated breaking logout

https://bugzilla.redhat.com/show_bug.cgi?id=1974891

errata-xmlrpc errata-xmlrpc@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=1974891

bugzilla＠redhat.com

23 Nov 23 Nov

12:35 p.m.

New subject: [Bug 1974891] CVE-2021-34428 jetty: SessionListener can prevent a session from being invalidated breaking logout

https://bugzilla.redhat.com/show_bug.cgi?id=1974891

--- Comment #16 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:

Red Hat Integration

Via RHSA-2021:4767 https://access.redhat.com/errata/RHSA-2021:4767

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=1974891

bugzilla＠redhat.com

12:35 p.m.

New subject: [Bug 1974891] CVE-2021-34428 jetty: SessionListener can prevent a session from being invalidated breaking logout

https://bugzilla.redhat.com/show_bug.cgi?id=1974891

errata-xmlrpc errata-xmlrpc@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=1974891

bugzilla＠redhat.com

14 Dec 14 Dec

11:35 p.m.

New subject: [Bug 1974891] CVE-2021-34428 jetty: SessionListener can prevent a session from being invalidated breaking logout

https://bugzilla.redhat.com/show_bug.cgi?id=1974891

--- Comment #17 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:

Red Hat Fuse 7.10

Via RHSA-2021:5134 https://access.redhat.com/errata/RHSA-2021:5134

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=1974891

bugzilla＠redhat.com

11:35 p.m.

New subject: [Bug 1974891] CVE-2021-34428 jetty: SessionListener can prevent a session from being invalidated breaking logout

https://bugzilla.redhat.com/show_bug.cgi?id=1974891

errata-xmlrpc errata-xmlrpc@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=1974891

bugzilla＠redhat.com

8 Jun 8 Jun

2:48 a.m.

New subject: [Bug 1974891] CVE-2021-34428 jetty: SessionListener can prevent a session from being invalidated breaking logout

https://bugzilla.redhat.com/show_bug.cgi?id=1974891 Bug 1974891 depends on bug 1974892, which changed state.

Bug 1974892 Summary: CVE-2021-34428 jetty: SessionListener can prevent a session from being invalidated breaking logout [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1974892

What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CLOSED Resolution|--- |EOL

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=1974891

910

Age (days ago)

1260

Last active (days ago)

java-sig-commits@lists.fedoraproject.org

26 comments

1 participants

tags (0)

participants (1)

bugzilla＠redhat.com