PT-2021-3392 · Eclipse+2 · Eclipse Jetty+2

Published 2021-06-22 · Updated 2024-11-26 · CVE-2021-34428

Positive Technologies (AI Summary)

CVSS v2.0

3.6

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Eclipse Jetty versions <= 9.4.40 Eclipse Jetty versions <= 10.0.2 Eclipse Jetty versions <= 11.0.2

Description The issue is related to the SessionListener#sessionDestroyed() method, where if an exception is thrown, the session ID is not invalidated in the session ID manager. This can result in a session not being invalidated, particularly in deployments with clustered sessions and multiple contexts. It can lead to an application being left logged in on a shared computer. There is no known path for an attacker to induce such an exception, so they must rely on an application to throw it. The getLastAccessedTime() method may throw an IllegalStateException, potentially contrary to the servlet spec, causing applications to fail to log out.

Recommendations For Eclipse Jetty versions <= 9.4.40, catch all Throwables within the SessionListener#sessionDestroyed() implementations. For Eclipse Jetty versions <= 10.0.2, catch all Throwables within the SessionListener#sessionDestroyed() implementations. For Eclipse Jetty versions <= 11.0.2, catch all Throwables within the SessionListener#sessionDestroyed() implementations.

Fix

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

ALT-PU-2024-16002

ALT-PU-2024-16022

ALT-PU-2024-16072

BDU:2021-03243

CVE-2021-34428

DSA-4949-1

GHSA-M6CP-VXJX-65J6

OESA-2021-1263

RHSA-2021:3758

Affected Products

Alt Linux

Astra Linux

Eclipse Jetty

References · 35

• https://osv.dev/vulnerability/UBUNTU-CVE-2021-34428 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-34428 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-03243 · Security Note
• https://oracle.com/security-alerts/cpujan2022.html · Patch
• https://osv.dev/vulnerability/OESA-2021-1263 · Vendor Advisory
• https://debian.org/security/2021/dsa-4949 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-34428 · Security Note
• https://oracle.com/security-alerts/cpuoct2021.html · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-34428 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2021-1126SE17 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-34428 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-34428 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4949-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-m6cp-vxjx-65j6 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-34428 · Security Note