Insufficient Session Expiration in Jetty - CVE-2021-34428

Vulnerability identifier: #VU55642

CSH Severity: Low

CVSS v4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-34428

CWE-ID: CWE-613

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows an attacker to gain access to sensitive information.

The vulnerability exists due to insufficient session expiration issue. If an exception is thrown from the SessionListener#sessionDestroyed() method, then the session ID is not invalidated in the session ID manager. On deployments with clustered sessions and multiple contexts this can result in a session not being invalidated.

Jetty
Security Directory Integrator
Installation Manager
Rational Performance Tester
IBM Security Verify Directory
StreamSets Data Collector
IBM Security Directory Suite
toolbox (Red Hat package)
coreos-installer (Red Hat package)
butane (Red Hat package)
console-login-helper-messages (Red Hat package)
python-eventlet (Red Hat package)
python-hardware (Red Hat package)
ignition (Red Hat package)
runc (Red Hat package)
cri-tools (Red Hat package)
cri-o (Red Hat package)
python-sushy-oem-idrac (Red Hat package)
kata-containers (Red Hat package)
python-ironic-prometheus-exporter (Red Hat package)
haproxy (Red Hat package)
openvswitch2.15 (Red Hat package)
jenkins (Red Hat package)
python-sushy (Red Hat package)
openshift (Red Hat package)
openshift-clients (Red Hat package)
openshift-kuryr (Red Hat package)
python-ironic-lib (Red Hat package)
atomic-openshift-service-idler (Red Hat package)
jenkins-2-plugins (Red Hat package)
rust-afterburn (Red Hat package)
jetty9 (Debian package)
openstack-ironic-inspector (Red Hat package)
ironic-images (Red Hat package)
python-wcwidth (Red Hat package)
rust-bootupd (Red Hat package)
python-scciclient (Red Hat package)
python-cmd2 (Red Hat package)
python-pyperclip (Red Hat package)
python-pycdlib (Red Hat package)
python-osc-lib (Red Hat package)
openvswitch2.16 (Red Hat package)
python-cliff (Red Hat package)
python-ironicclient (Red Hat package)
python-dracclient (Red Hat package)
openstack-ironic-python-agent (Red Hat package)
jetty-proxy
jetty-util
jetty-plus
jetty-jaspi
jetty-deploy
jetty-cdi
jetty-rewrite
jetty-websocket-server
jetty-jndi
jetty-fcgi-server
jetty-websocket-api
jetty-http2-client
jetty-security
jetty-alpn-server
jetty-client
jetty-servlet
jetty-osgi-boot
jetty-http-spi
jetty-http2-common
jetty-annotations
jetty-websocket-common
jetty-websocket-servlet
jetty-http
jetty-nosql
jetty-unixsocket
jetty-osgi-alpn
jetty-alpn-client
jetty-http2-http-client-transport
jetty-util-ajax
jetty-start
jetty-jstl
jetty-io
jetty-httpservice
jetty
jetty-jmx
jetty-spring
jetty-javax-websocket-client-impl
jetty-http2-hpack
jetty-osgi-boot-jsp
jetty-project
jetty-maven-plugin
jetty-xml
jetty-quickstart
jetty-javadoc
jetty-fcgi-client
jetty-jspc-maven-plugin
jetty-osgi-boot-warurl
jetty-jaas
jetty-javax-websocket-server-impl
jetty-server
jetty-jsp
jetty-websocket-client
jetty-ant
jetty-continuation
jetty-webapp
jetty-http2-server
jetty-servlets
jetty-infinispan
openstack-ironic (Red Hat package)
ovn21.09 (Red Hat package)
redhat-release-coreos (Red Hat package)
Sterling Connect:Direct Browser User Interface
Rational Change
AMQ Streams
AMQ Broker
Fuse
IBM Analytic Accelerator Framework for Communication Service Providers
Traffix SDC
Red Hat OpenShift Container Platform
IBM Qradar SIEM
IBM Cognos Command Center
IBM Customer and Network Analytics for Communications Service Providers and Datasets
Netcool Operations Insight
IBM Process Mining
IBM MaaS360 Mobile Enterprise Gateway
IBM Sterling B2B Integrator
IBM Cloud Application Performance Management (APM)
IBM Spectrum Protect Storage Agent
IBM Security Verify Governance
openEuler
IBM Cognos Analytics
IBM InfoSphere Information Server

Install updates from vendor's website.

Jetty - addressed in versions 9.4.41.v20210516, 10.0.3, 11.0.3
toolbox (Red Hat package) - update to 0.0.8-3.rhaos4.9.el8
coreos-installer (Red Hat package) - update to 0.10.0-2.rhaos4.9.el8
butane (Red Hat package) - update to 0.13.1-1.rhaos4.9.el8
console-login-helper-messages (Red Hat package) - update to 0.20.3-1.rhaos4.9.el8
python-eventlet (Red Hat package) - update to 0.30.2-1.el8
python-hardware (Red Hat package) - update to 0.28.0-0.20210719162211.96c9863.el8
ignition (Red Hat package) - update to 2.12.0-1.rhaos4.9.el8
runc (Red Hat package) - update to 1.0.1-2.rhaos4.9.git4144b63.el8
Sterling Connect:Direct Browser User Interface - update to 1.5.0.2 iFix-32
AMQ Streams - update to 1.8.0
Installation Manager - update to 1.10.1.0
cri-tools (Red Hat package) - update to 1.22.0-1.el8
cri-o (Red Hat package) - update to 1.22.0-73.rhaos4.9.gitbdf286c.el8
python-sushy-oem-idrac (Red Hat package) - update to 2.0.1-0.20210326153413.83b7eb0.el8
kata-containers (Red Hat package) - update to 2.1.0-6.el8
python-ironic-prometheus-exporter (Red Hat package) - update to 2.3.0-0.20210611093526.3c9b517.el8
haproxy (Red Hat package) - update to 2.2.15-1.el8
openvswitch2.15 (Red Hat package) - update to 2.15.0-28.el8fdp
jenkins (Red Hat package) - update to 2.289.3.1630554997-1.el8
python-sushy (Red Hat package) - update to 3.11.0-0.20210802160404.b93dcba.el8
IBM Analytic Accelerator Framework for Communication Service Providers - update to 3.6.0.12.0
openshift (Red Hat package) - update to 4.9.0-202110080828.p0.git.894a78b.assembly.stream.el8
openshift-clients (Red Hat package) - update to 4.9.0-202109101042.p0.git.96e95ce.assembly.stream.el8
openshift-kuryr (Red Hat package) - update to 4.9.0-202109101042.p0.git.e66f211.assembly.stream.el8
python-ironic-lib (Red Hat package) - update to 4.7.2-0.20210707162243.d33cf3e.el8
atomic-openshift-service-idler (Red Hat package) - update to 4.9.0-202109101042.p0.git.39cfc66.assembly.stream.el8
jenkins-2-plugins (Red Hat package) - update to 4.9.1630555871-1.el8
rust-afterburn (Red Hat package) - update to 5.1.0-1.rhaos4.9.el8
Traffix SDC - update to 5.1.0 CF-35
Rational Change - update to 5.3.2.5
IBM Qradar SIEM - addressed in versions 7.3.3 Fix Pack 12, 7.4.3 Fix Pack 6, 7.5.0 Update Pack 2
AMQ Broker - update to 7.9.0
jetty9 (Debian package) - update to 9.4.16-0+deb10u1
IBM Customer and Network Analytics for Communications Service Providers and Datasets - update to 9.6.0.12.3
openstack-ironic-inspector (Red Hat package) - update to 10.7.1-0.20210722154052.edf655c.el8
ironic-images (Red Hat package) - update to 2021.2-20210827.1.el8
python-wcwidth (Red Hat package) - update to 0.1.7-14.el8ost
rust-bootupd (Red Hat package) - update to 0.2.5-3.rhaos4.9.el8
python-scciclient (Red Hat package) - update to 0.9.1-0.20210720102209.34ccd96.el8
python-cmd2 (Red Hat package) - update to 1.4.0-1.1.el8
python-pyperclip (Red Hat package) - update to 1.6.4-6.el8ost
Netcool Operations Insight - update to 1.6.7
python-pycdlib (Red Hat package) - update to 1.11.0-3.el8
IBM Process Mining - update to 1.12.0.4
python-osc-lib (Red Hat package) - update to 2.3.1-0.20210318171847.2b7a679.el8
openvswitch2.16 (Red Hat package) - update to 2.16.0-15.el8fdp
IBM MaaS360 Mobile Enterprise Gateway - update to 2.106.500
python-cliff (Red Hat package) - update to 3.7.0-0.20210318182629.117a100.el8
python-ironicclient (Red Hat package) - update to 4.7.1-0.20210611202214.3d146fb.el8
Red Hat OpenShift Container Platform - update to 4.9.0
python-dracclient (Red Hat package) - update to 5.1.1-0.20210318155434.98c7ea3.el8
IBM Sterling B2B Integrator - addressed in versions 6.0.3.7, 6.1.0.6, 6.1.1.2, 6.1.2.0
StreamSets Data Collector - update to 7.0.0
Fuse - update to 7.10.0
IBM Security Directory Suite - update to 8.0.1.21
openstack-ironic-python-agent (Red Hat package) - update to 8.1.1-0.20210722155129.7f3de67.el8
IBM Cloud Application Performance Management (APM) - update to 8.1.4.0.15
IBM Spectrum Protect Storage Agent - update to 8.1.19
jetty-proxy - update to 9.4.15-9
jetty-util - update to 9.4.15-9
jetty-plus - update to 9.4.15-9
jetty-jaspi - update to 9.4.15-9
jetty-deploy - update to 9.4.15-9
jetty-cdi - update to 9.4.15-9
jetty-rewrite - update to 9.4.15-9
jetty-websocket-server - update to 9.4.15-9
jetty-jndi - update to 9.4.15-9
jetty-fcgi-server - update to 9.4.15-9
jetty-websocket-api - update to 9.4.15-9
jetty-http2-client - update to 9.4.15-9
jetty-security - update to 9.4.15-9
jetty-alpn-server - update to 9.4.15-9
jetty-client - update to 9.4.15-9
jetty-servlet - update to 9.4.15-9
jetty-osgi-boot - update to 9.4.15-9
jetty-http-spi - update to 9.4.15-9
jetty-http2-common - update to 9.4.15-9
jetty-annotations - update to 9.4.15-9
jetty-websocket-common - update to 9.4.15-9
jetty-websocket-servlet - update to 9.4.15-9
jetty-http - update to 9.4.15-9
jetty-nosql - update to 9.4.15-9
jetty-unixsocket - update to 9.4.15-9
jetty-osgi-alpn - update to 9.4.15-9
jetty-alpn-client - update to 9.4.15-9
jetty-http2-http-client-transport - update to 9.4.15-9
jetty-util-ajax - update to 9.4.15-9
jetty-start - update to 9.4.15-9
jetty-jstl - update to 9.4.15-9
jetty-io - update to 9.4.15-9
jetty-httpservice - update to 9.4.15-9
jetty - update to 9.4.15-9
jetty-jmx - update to 9.4.15-9
jetty-spring - update to 9.4.15-9
jetty-javax-websocket-client-impl - update to 9.4.15-9
jetty-http2-hpack - update to 9.4.15-9
jetty-osgi-boot-jsp - update to 9.4.15-9
jetty-project - update to 9.4.15-9
jetty-maven-plugin - update to 9.4.15-9
jetty-xml - update to 9.4.15-9
jetty-quickstart - update to 9.4.15-9
jetty-javadoc - update to 9.4.15-9
jetty-fcgi-client - update to 9.4.15-9
jetty-jspc-maven-plugin - update to 9.4.15-9
jetty-osgi-boot-warurl - update to 9.4.15-9
jetty-jaas - update to 9.4.15-9
jetty-javax-websocket-server-impl - update to 9.4.15-9
jetty-server - update to 9.4.15-9
jetty-jsp - update to 9.4.15-9
jetty-websocket-client - update to 9.4.15-9
jetty-ant - update to 9.4.15-9
jetty-continuation - update to 9.4.15-9
jetty-webapp - update to 9.4.15-9
jetty-http2-server - update to 9.4.15-9
jetty-servlets - update to 9.4.15-9
jetty-infinispan - update to 9.4.15-9
IBM Security Verify Governance - update to 10.0.1.0.3
IBM Cognos Command Center - update to 10.2.4 Fix Pack 1 IF17
IBM Cognos Analytics - addressed in versions 11.2.4 FP4, 12.0.4
IBM InfoSphere Information Server - update to 11.7.1.4 Service pack 1
openstack-ironic (Red Hat package) - update to 18.1.1-0.20210812092216.4aec741.el8
ovn21.09 (Red Hat package) - update to 21.09.0-20.el8fdp
redhat-release-coreos (Red Hat package) - update to 49.84-2.el8

• https://github.com/eclipse/jetty.project/security/advisories/GHSA-m6cp-vxjx-65j6
• https://lists.apache.org/thread.html/ref1c161a1621504e673f9197b49e6efe5a33ce3f0e6d8f1f804fc695@%3Cjira.kafka.apache.org%3E

• Insufficient session expiration in Eclipse Jetty
• Debian update for jetty9
• Multiple vulnerabilities in Red Hat AMQ Streams
• Multiple vulnerabilities in Red Hat AMQ Broker
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.9
• Traffix SDC update for Eclipse Jetty
• Multiple vulnerabilities in IBM MaaS360 Mobile Enterprise Gateway
• Multiple vulnerabilities in IBM Sterling Connect:Direct Browser User Interface
• Multiple vulnerabilities in IBM Rational Performance Tester
• Multiple vulnerabilities in IBM QRadar SIEM
• Multiple vulnerabilities in IBM Rational Change
• Multiple vulnerabilities in IBM Sterling B2B Integrator
• Multiple vulnerabilities in IBM Security Verify Governance
• Multiple vulnerabilities in IBM Process Mining
• Multiple vulnerabilities in IBM Cognos Command Center
• Multiple vulnerabilities in IBM InfoSphere Information Server
• Multiple vulnerabilities in IBM Storage Protect Server
• Multiple vulnerabilities in IBM Analytic Accelerator Framework for Communication Service Providers & IBM Customer and Network Analytics
• Multiple vulnerabilities in Netcool Operations Insight
• Multiple vulnerabilities in IBM Application Performance Management
• openEuler 20.03 LTS SP1 update for jetty
• Multiple vulnerabilities in IBM Security Directory Integrator
• Multiple vulnerabilities in IBM Security Verify Directory
• Multiple vulnerabilities in IBM Cognos Analytics
• Multiple vulnerabilities in IBM Security Directory Suite
• Multiple vulnerabilities in Fuse 7.10
• Multiple vulnerabilities in IBM Installation Manager
• Multiple vulnerabilities in IBM StreamSets Data Collector