Input validation error in Jetty - CVE-2021-28169

Vulnerability identifier: #VU53973

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-28169

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain access to sensitive information..

The vulnerability exists due to a double decoding issue when parsing URI with certain characters. A remote attacker can send requests to the ConcatServlet and WelcomeFilter and view contents of protected resources within the WEB-INF directory.

Example:

/concat?/%2557EB-INF/web.xml

Jetty
IBM Business Automation Workflow
Red Hat Integration Camel-K
IBM Customer and Network Analytics for Communications Service Providers and Datasets
IBM Integration Bus
Netcool Operations Insight
IBM Process Mining
IBM MaaS360 Mobile Enterprise Gateway
IBM Sterling B2B Integrator
IBM Cloud Application Performance Management (APM)
IBM Spectrum Protect Storage Agent
IBM Security Verify Governance
Dell NetWorker Virtual Edition
Security Directory Integrator
Rational Performance Tester
IBM Security Verify Directory
IBM Enterprise Records
StreamSets Data Collector
IBM Security Directory Suite
IBM Engineering Systems Design Rhapsody
webMethods BPM
toolbox (Red Hat package)
coreos-installer (Red Hat package)
butane (Red Hat package)
console-login-helper-messages (Red Hat package)
python-eventlet (Red Hat package)
python-hardware (Red Hat package)
ignition (Red Hat package)
runc (Red Hat package)
cri-tools (Red Hat package)
cri-o (Red Hat package)
python-sushy-oem-idrac (Red Hat package)
kata-containers (Red Hat package)
python-ironic-prometheus-exporter (Red Hat package)
haproxy (Red Hat package)
openvswitch2.15 (Red Hat package)
jenkins (Red Hat package)
python-sushy (Red Hat package)
openshift (Red Hat package)
openshift-clients (Red Hat package)
openshift-kuryr (Red Hat package)
python-ironic-lib (Red Hat package)
atomic-openshift-service-idler (Red Hat package)
jenkins-2-plugins (Red Hat package)
rust-afterburn (Red Hat package)
openstack-ironic-inspector (Red Hat package)
ironic-images (Red Hat package)
python-wcwidth (Red Hat package)
rust-bootupd (Red Hat package)
python-scciclient (Red Hat package)
python-cmd2 (Red Hat package)
python-pyperclip (Red Hat package)
python-pycdlib (Red Hat package)
python-osc-lib (Red Hat package)
openvswitch2.16 (Red Hat package)
python-cliff (Red Hat package)
python-ironicclient (Red Hat package)
python-dracclient (Red Hat package)
openstack-ironic-python-agent (Red Hat package)
jetty-security
jetty-jsp
jetty-http2-client
jetty-project
jetty-jmx
jetty-alpn-server
jetty-alpn-client
jetty-http2-server
jetty-javax-websocket-server-impl
jetty-websocket-servlet
jetty-http2-hpack
jetty-ant
jetty-rewrite
jetty-continuation
jetty-fcgi-server
jetty-http
jetty-osgi-boot
jetty-servlet
jetty-httpservice
jetty-osgi-alpn
jetty-websocket-api
jetty-websocket-client
jetty-deploy
jetty-start
jetty-jaas
jetty-unixsocket
jetty-infinispan
jetty-http2-http-client-transport
jetty-nosql
jetty-client
jetty-webapp
jetty-proxy
jetty-jndi
jetty-plus
jetty-fcgi-client
jetty-jstl
jetty-servlets
jetty
jetty-javax-websocket-client-impl
jetty-websocket-common
jetty-util-ajax
jetty-io
jetty-jaspi
jetty-http2-common
jetty-jspc-maven-plugin
jetty-util
jetty-maven-plugin
jetty-quickstart
jetty-xml
jetty-javadoc
jetty-annotations
jetty-cdi
jetty-osgi-boot-warurl
jetty-server
jetty-osgi-boot-jsp
jetty-spring
jetty-http-spi
jetty-websocket-server
openstack-ironic (Red Hat package)
ovn21.09 (Red Hat package)
redhat-release-coreos (Red Hat package)
Sterling Connect:Direct Browser User Interface
Rational Change
AMQ Streams
AMQ Broker
Fuse
Oracle Communications Cloud Native Core Policy
Apache Pulsar
IBM Analytic Accelerator Framework for Communication Service Providers
Traffix SDC
Red Hat OpenShift Container Platform
IBM Qradar SIEM
IBM Cognos Command Center
IBM App Connect Enterprise
SUSE Linux Enterprise Module for Development Tools
openEuler
IBM Cognos Analytics
IBM InfoSphere Information Server

Install updates from vendor's website.

Jetty - addressed in versions 9.4.41.v20210512, 10.0.4, 11.0.3
toolbox (Red Hat package) - update to 0.0.8-3.rhaos4.9.el8
coreos-installer (Red Hat package) - update to 0.10.0-2.rhaos4.9.el8
butane (Red Hat package) - update to 0.13.1-1.rhaos4.9.el8
console-login-helper-messages (Red Hat package) - update to 0.20.3-1.rhaos4.9.el8
python-eventlet (Red Hat package) - update to 0.30.2-1.el8
python-hardware (Red Hat package) - update to 0.28.0-0.20210719162211.96c9863.el8
ignition (Red Hat package) - update to 2.12.0-1.rhaos4.9.el8
runc (Red Hat package) - update to 1.0.1-2.rhaos4.9.git4144b63.el8
Sterling Connect:Direct Browser User Interface - update to 1.5.0.2 iFix-32
AMQ Streams - update to 1.8.0
Red Hat Integration Camel-K - update to 1.8.1
cri-tools (Red Hat package) - update to 1.22.0-1.el8
cri-o (Red Hat package) - update to 1.22.0-73.rhaos4.9.gitbdf286c.el8
Apache Pulsar - update to 2.8.0
python-sushy-oem-idrac (Red Hat package) - update to 2.0.1-0.20210326153413.83b7eb0.el8
kata-containers (Red Hat package) - update to 2.1.0-6.el8
python-ironic-prometheus-exporter (Red Hat package) - update to 2.3.0-0.20210611093526.3c9b517.el8
haproxy (Red Hat package) - update to 2.2.15-1.el8
openvswitch2.15 (Red Hat package) - update to 2.15.0-28.el8fdp
jenkins (Red Hat package) - update to 2.289.3.1630554997-1.el8
python-sushy (Red Hat package) - update to 3.11.0-0.20210802160404.b93dcba.el8
IBM Analytic Accelerator Framework for Communication Service Providers - update to 3.6.0.12.0
openshift (Red Hat package) - update to 4.9.0-202110080828.p0.git.894a78b.assembly.stream.el8
openshift-clients (Red Hat package) - update to 4.9.0-202109101042.p0.git.96e95ce.assembly.stream.el8
openshift-kuryr (Red Hat package) - update to 4.9.0-202109101042.p0.git.e66f211.assembly.stream.el8
python-ironic-lib (Red Hat package) - update to 4.7.2-0.20210707162243.d33cf3e.el8
atomic-openshift-service-idler (Red Hat package) - update to 4.9.0-202109101042.p0.git.39cfc66.assembly.stream.el8
jenkins-2-plugins (Red Hat package) - update to 4.9.1630555871-1.el8
rust-afterburn (Red Hat package) - update to 5.1.0-1.rhaos4.9.el8
Rational Change - update to 5.3.2.5
IBM Qradar SIEM - addressed in versions 7.3.3 Fix Pack 10, 7.3.3 Fix Pack 12, 7.4.3 Fix Pack 3, 7.4.3 Fix Pack 4, 7.4.3 Fix Pack 6, 7.5.0 Update Pack 2
AMQ Broker - update to 7.9.0
IBM Customer and Network Analytics for Communications Service Providers and Datasets - update to 9.6.0.12.3
openstack-ironic-inspector (Red Hat package) - update to 10.7.1-0.20210722154052.edf655c.el8
ironic-images (Red Hat package) - update to 2021.2-20210827.1.el8
python-wcwidth (Red Hat package) - update to 0.1.7-14.el8ost
rust-bootupd (Red Hat package) - update to 0.2.5-3.rhaos4.9.el8
python-scciclient (Red Hat package) - update to 0.9.1-0.20210720102209.34ccd96.el8
python-cmd2 (Red Hat package) - update to 1.4.0-1.1.el8
python-pyperclip (Red Hat package) - update to 1.6.4-6.el8ost
Netcool Operations Insight - update to 1.6.9
python-pycdlib (Red Hat package) - update to 1.11.0-3.el8
IBM Process Mining - update to 1.12.0.4
python-osc-lib (Red Hat package) - update to 2.3.1-0.20210318171847.2b7a679.el8
openvswitch2.16 (Red Hat package) - update to 2.16.0-15.el8fdp
IBM MaaS360 Mobile Enterprise Gateway - update to 2.106.500
python-cliff (Red Hat package) - update to 3.7.0-0.20210318182629.117a100.el8
python-ironicclient (Red Hat package) - update to 4.7.1-0.20210611202214.3d146fb.el8
Red Hat OpenShift Container Platform - update to 4.9.0
python-dracclient (Red Hat package) - update to 5.1.1-0.20210318155434.98c7ea3.el8
IBM Enterprise Records - update to 5.2.1.8 IF002
IBM Sterling B2B Integrator - addressed in versions 6.0.3.7, 6.1.0.6, 6.1.1.2, 6.1.2.0
StreamSets Data Collector - update to 7.0.0
Fuse - update to 7.10.0
IBM Security Directory Suite - update to 8.0.1.21
openstack-ironic-python-agent (Red Hat package) - update to 8.1.1-0.20210722155129.7f3de67.el8
IBM Cloud Application Performance Management (APM) - update to 8.1.4.0.15
IBM Spectrum Protect Storage Agent - update to 8.1.19
IBM Engineering Systems Design Rhapsody - addressed in versions 9.0.1.0.6, 9.0.2.0.2
jetty-security - update to 9.4.15-8
jetty-jsp - update to 9.4.15-8
jetty-http2-client - update to 9.4.15-8
jetty-project - update to 9.4.15-8
jetty-jmx - update to 9.4.15-8
jetty-alpn-server - update to 9.4.15-8
jetty-alpn-client - update to 9.4.15-8
jetty-http2-server - update to 9.4.15-8
jetty-javax-websocket-server-impl - update to 9.4.15-8
jetty-websocket-servlet - update to 9.4.15-8
jetty-http2-hpack - update to 9.4.15-8
jetty-ant - update to 9.4.15-8
jetty-rewrite - update to 9.4.15-8
jetty-continuation - update to 9.4.15-8
jetty-fcgi-server - update to 9.4.15-8
jetty-http - update to 9.4.15-8
jetty-osgi-boot - update to 9.4.15-8
jetty-servlet - update to 9.4.15-8
jetty-httpservice - update to 9.4.15-8
jetty-osgi-alpn - update to 9.4.15-8
jetty-websocket-api - update to 9.4.15-8
jetty-websocket-client - update to 9.4.15-8
jetty-deploy - update to 9.4.15-8
jetty-start - update to 9.4.15-8
jetty-jaas - update to 9.4.15-8
jetty-unixsocket - update to 9.4.15-8
jetty-infinispan - update to 9.4.15-8
jetty-http2-http-client-transport - update to 9.4.15-8
jetty-nosql - update to 9.4.15-8
jetty-client - update to 9.4.15-8
jetty-webapp - update to 9.4.15-8
jetty-proxy - update to 9.4.15-8
jetty-jndi - update to 9.4.15-8
jetty-plus - update to 9.4.15-8
jetty-fcgi-client - update to 9.4.15-8
jetty-jstl - update to 9.4.15-8
jetty-servlets - update to 9.4.15-8
jetty - update to 9.4.15-8
jetty-javax-websocket-client-impl - update to 9.4.15-8
jetty-websocket-common - update to 9.4.15-8
jetty-util-ajax - update to 9.4.15-8
jetty-io - update to 9.4.15-8
jetty-jaspi - update to 9.4.15-8
jetty-http2-common - update to 9.4.15-8
jetty-jspc-maven-plugin - update to 9.4.15-8
jetty-util - update to 9.4.15-8
jetty-maven-plugin - update to 9.4.15-8
jetty-quickstart - update to 9.4.15-8
jetty-xml - update to 9.4.15-8
jetty-javadoc - update to 9.4.15-8
jetty-annotations - update to 9.4.15-8
jetty-cdi - update to 9.4.15-8
jetty-osgi-boot-warurl - update to 9.4.15-8
jetty-server - update to 9.4.15-8
jetty-osgi-boot-jsp - update to 9.4.15-8
jetty-spring - update to 9.4.15-8
jetty-http-spi - update to 9.4.15-8
jetty-websocket-server - update to 9.4.15-8
jetty-http - update to 9.4.42-3.9.1
jetty-io - update to 9.4.42-3.9.1
jetty-security - update to 9.4.42-3.9.1
jetty-server - update to 9.4.42-3.9.1
jetty-servlet - update to 9.4.42-3.9.1
jetty-util - update to 9.4.42-3.9.1
jetty-util-ajax - update to 9.4.42-3.9.1
IBM Security Verify Governance - update to 10.0.1.0.3
IBM Cognos Command Center - update to 10.2.4 Fix Pack 1 IF17
webMethods BPM - addressed in versions 10.15 Fix 15, 11.1 Fix 3
IBM Cognos Analytics - addressed in versions 11.2.4 FP4, 12.0.4
IBM InfoSphere Information Server - update to 11.7.1.4 Service pack 1
openstack-ironic (Red Hat package) - update to 18.1.1-0.20210812092216.4aec741.el8
Dell NetWorker Virtual Edition - addressed in versions 19.8.0.4, 19.9.0.2
ovn21.09 (Red Hat package) - update to 21.09.0-20.el8fdp
redhat-release-coreos (Red Hat package) - update to 49.84-2.el8

• https://github.com/eclipse/jetty.project/security/advisories/GHSA-gwcr-j4wh-j3cq
• https://bugs.eclipse.org/bugs/show_bug.cgi?id=573389

• Information disclosure in Eclipse Jetty
• Multiple vulnerabilities in Apache Pulsar
• Multiple vulnerabilities in Red Hat AMQ Streams
• Multiple vulnerabilities in Red Hat AMQ Broker
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.9
• Multiple vulnerabilities in IBM QRadar SIEM
• Multiple vulnerabilities in IBM QRadar SIEM
• Multiple vulnerabilities in IBM QRadar SIEM
• Information disclosure in Traffix SDC (Eclipse Jetty)
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Policy
• Multiple vulnerabilities in IBM MaaS360 Mobile Enterprise Gateway
• SUSE update for jetty-minimal
• Multiple vulnerabilities in IBM Sterling Connect:Direct Browser User Interface
• Multiple vulnerabilities in IBM Rational Performance Tester
• Multiple vulnerabilities in IBM QRadar SIEM
• Multiple vulnerabilities in IBM Rational Change
• Multiple vulnerabilities in IBM Sterling B2B Integrator
• Multiple vulnerabilities in IBM Enterprise Records
• Multiple vulnerabilities in Red Hat Integration Camel-K
• Multiple vulnerabilities in IBM Security Verify Governance
• Multiple vulnerabilities in IBM Process Mining
• Multiple vulnerabilities in IBM Cognos Command Center
• Multiple vulnerabilities in IBM InfoSphere Information Server
• Multiple vulnerabilities in IBM App Connect Enterprise Toolkit and the IBM Integration Bus Toolkit
• Multiple vulnerabilities in IBM Storage Protect Server
• Multiple vulnerabilities in Netcool Operations Insight
• Multiple vulnerabilities in IBM Analytic Accelerator Framework for Communication Service Providers & IBM Customer and Network Analytics
• Multiple vulnerabilities in Dell NetWorker Virtual Edition
• Multiple vulnerabilities in IBM Application Performance Management
• openEuler 20.03 LTS SP1 update for jetty
• Multiple vulnerabilities in IBM Security Directory Integrator
• Multiple vulnerabilities in IBM Engineering Systems Design Rhapsody
• Multiple vulnerabilities in IBM Security Verify Directory
• Multiple vulnerabilities in IBM Cognos Analytics
• Multiple vulnerabilities in IBM Security Directory Suite
• Multiple vulnerabilities in Fuse 7.10
• Multiple vulnerabilities in IBM Business Automation Workflow traditional
• Multiple vulnerabilities in IBM StreamSets Data Collector
• Multiple vulnerabilities in IBM webMethods BPM