{"id":"CVE-2021-34428","aliases":["CLSA-2026-1768522122","CLSA-2026-1790767173","DEBIAN-CVE-2021-34428","DSA-4949-1","EUVD-2021-1354","GHSA-m6cp-vxjx-65j6","OESA-2021-1263","RHSA-2021:3758","UBUNTU-CVE-2021-34428"],"status":"published","title":"SessionListener can prevent a session from being invalidated breaking logout","description":"For Eclipse Jetty versions \u003c= 9.4.40, \u003c= 10.0.2, \u003c= 11.0.2, if an exception is thrown from the SessionListener#sessionDestroyed() method, then the session ID is not invalidated in the session ID manager. On deployments with clustered sessions and multiple contexts this can result in a session not being invalidated. This can result in an application used on a shared computer being left logged in.","severity":{"version":"3.1","score":2.9,"vector":"CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00963,"percentile":0.62088,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-613"],"published":"2021-06-22T14:45:11Z","modified":"2026-11-02T19:46:25Z","exploits":[{"source":"pocgithub","id":"Trinadh465/jetty_9.4.31_CVE-2021-34428","title":"Trinadh465/jetty_9.4.31_CVE-2021-34428","date":"2023-11-01","url":"https://github.com/Trinadh465/jetty_9.4.31_CVE-2021-34428"}],"fixes":[{"ecosystem":"Maven","package":"org.eclipse.jetty:jetty-server","fixed_in":["9.4.41","10.0.3","11.0.3"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"jetty9","fixed_in":["9.4.39-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"jetty9","fixed_in":["9.4.39-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"jetty9","fixed_in":["9.4.39-2"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"jetty","fixed_in":["9.4.15-9.oe1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.eclipse.jetty:jetty-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"9.4.40"},{"fixed":"9.4.41"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.eclipse.jetty:jetty-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0"},{"last_affected":"10.0.2"},{"fixed":"10.0.3"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.eclipse.jetty:jetty-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0"},{"last_affected":"11.0.2"},{"fixed":"11.0.3"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.2.0.v20160908"},{"fixed":"8.2.0.v20160908-tuxcare.1"}]}],"versions":["8.2.0.v20160908"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.2.0.v20160908"},{"fixed":"8.2.0.v20160908-tuxcare.1"}]}],"versions":["8.2.0.v20160908"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.http2:http2-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.24.v20191120"},{"fixed":"9.4.24.v20191120-tuxcare.5"}]}],"versions":["9.4.24.v20191120","9.4.24.v20191120-tuxcare.1","9.4.24.v20191120-tuxcare.2","9.4.24.v20191120-tuxcare.3","9.4.24.v20191120-tuxcare.4"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.http2:http2-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.24.v20191120"},{"fixed":"9.4.24.v20191120-tuxcare.5"}]}],"versions":["9.4.24.v20191120","9.4.24.v20191120-tuxcare.1","9.4.24.v20191120-tuxcare.2","9.4.24.v20191120-tuxcare.3","9.4.24.v20191120-tuxcare.4"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.24.v20191120"},{"fixed":"9.4.24.v20191120-tuxcare.5"}]}],"versions":["9.4.24.v20191120","9.4.24.v20191120-tuxcare.1","9.4.24.v20191120-tuxcare.2","9.4.24.v20191120-tuxcare.3","9.4.24.v20191120-tuxcare.4"],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.39-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.39-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.39-2"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.16-0+deb10u1"}]}],"versions":["9.4.15-1"],"bundled":7},{"source":"osv","ecosystem":"Maven","package":"org.eclipse.jetty:jetty-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.41"}]}],"versions":["7.0.0.M0","7.0.0.M1","7.0.0.M2","7.0.0.M3","7.0.0.M4","7.0.0.RC0","7.0.0.RC1","7.0.0.RC2","7.0.0.RC3","7.0.0.RC4","7.0.0.RC5","7.0.0.RC6","7.0.0.v20091005","7.0.1.v20091125","7.0.2.RC0","7.0.2.v20100331","7.1.0.RC0","7.1.0.RC1","7.1.0.v20100505","7.1.1.v20100517","7.1.2.v20100523","7.1.3.v20100526","7.1.4.v20100610","7.1.5.v20100705","7.1.6.v20100715","7.2.0.RC0","7.2.0.v20101020","7.2.1.v20101111","7.2.2.v20101205","7.3.0.v20110203","7.3.1.v20110307","7.4.0.RC0","7.4.0.v20110414","7.4.1.v20110513","7.4.2.v20110526","7.4.3.v20110701","7.4.4.v20110707","7.4.5.v20110725","7.5.0.RC0","7.5.0.RC1","7.5.0.RC2","7.5.0.v20110901","7.5.1.v20110908","7.5.2.v20111006","7.5.3.v20111011","7.5.4.v20111024","7.6.0.RC0","7.6.0.RC1","7.6.0.RC2","7.6.0.RC3","7.6.0.RC4","7.6.0.RC5","7.6.0.v20120127","7.6.1.v20120215","7.6.10.v20130312","7.6.11.v20130520","7.6.12.v20130726","7.6.13.v20130916","7.6.14.v20131031","7.6.15.v20140411","7.6.16.v20140903","7.6.17.v20150415","7.6.18.v20150929","7.6.19.v20160209","7.6.2.v20120308","7.6.20.v20160902","7.6.21.v20160908","7.6.3.v20120416","7.6.4.v20120524","7.6.5.v20120716","7.6.6.v20120903","7.6.7.v20120910","7.6.8.v20121106","7.6.9.v20130131","8.0.0.M0","8.0.0.M1","8.0.0.M2","8.0.0.M3","8.0.0.RC0","8.0.0.v20110901","8.0.1.v20110908","8.0.2.v20111006","8.0.3.v20111011","8.0.4.v20111024","8.1.0.RC0","8.1.0.RC1","8.1.0.RC2","8.1.0.RC4","8.1.0.RC5","8.1.0.v20120127","8.1.1.v20120215","8.1.10.v20130312","8.1.11.v20130520","8.1.12.v20130726","8.1.13.v20130916","8.1.14.v20131031","8.1.15.v20140411","8.1.16.v20140903","8.1.17.v20150415","8.1.18.v20150929","8.1.19.v20160209","8.1.2.v20120308","8.1.20.v20160902","8.1.21.v20160908","8.1.22.v20160922","8.1.3.v20120416","8.1.4.v20120524","8.1.5.v20120716","8.1.6.v20120903","8.1.7.v20120910","8.1.8.v20121106","8.1.9.v20130131","8.2.0.v20160908","9.0.0.M0","9.0.0.M1","9.0.0.M2","9.0.0.M3","9.0.0.M4","9.0.0.M5","9.0.0.RC0","9.0.0.RC1","9.0.0.RC2","9.0.0.v20130308","9.0.1.v20130408","9.0.2.v20130417","9.0.3.v20130506","9.0.4.v20130625","9.0.5.v20130815","9.0.6.v20130930","9.0.7.v20131107","9.1.0.M0","9.1.0.RC0","9.1.0.RC1","9.1.0.RC2","9.1.0.v20131115","9.1.1.v20140108","9.1.2.v20140210","9.1.3.v20140225","9.1.4.v20140401","9.1.5.v20140505","9.1.6.v20160112","9.2.0.M0","9.2.0.M1","9.2.0.RC0","9.2.0.v20140526","9.2.1.v20140609","9.2.10.v20150310","9.2.11.M0","9.2.11.v20150529","9.2.12.M0","9.2.12.v20150709","9.2.13.v20150730","9.2.14.v20151106","9.2.15.v20160210","9.2.16.v20160414","9.2.17.v20160517","9.2.18.v20160721","9.2.19.v20160908","9.2.2.v20140723","9.2.20.v20161216","9.2.21.v20170120","9.2.22.v20170606","9.2.23.v20171218","9.2.24.v20180105","9.2.25.v20180606","9.2.26.v20180806","9.2.27.v20190403","9.2.28.v20190418","9.2.29.v20191105","9.2.3.v20140905","9.2.30.v20200428","9.2.4.v20141103","9.2.5.v20141112","9.2.6.v20141205","9.2.7.v20150116","9.2.8.v20150217","9.2.9.v20150224","9.3.0.M0","9.3.0.M1","9.3.0.M2","9.3.0.RC0","9.3.0.RC1","9.3.0.v20150612","9.3.1.v20150714","9.3.10.M0","9.3.10.v20160621","9.3.11.M0","9.3.11.v20160721","9.3.12.v20160915","9.3.13.M0","9.3.13.v20161014","9.3.14.v20161028","9.3.15.v20161220","9.3.16.v20170120","9.3.17.RC0","9.3.17.v20170317","9.3.18.v20170406","9.3.19.v20170502","9.3.2.v20150730","9.3.20.v20170531","9.3.21.M0","9.3.21.RC0","9.3.21.v20170918","9.3.22.v20171030","9.3.23.v20180228","9.3.24.v20180605","9.3.25.v20180904","9.3.26.v20190403","9.3.27.v20190418","9.3.28.v20191105","9.3.29.v20201019","9.3.3.v20150827","9.3.30.v20211001","9.3.4.RC0","9.3.4.RC1","9.3.4.v20151007","9.3.5.v20151012","9.3.6.v20151106","9.3.7.RC0","9.3.7.RC1","9.3.7.v20160115","9.3.8.RC0","9.3.8.v20160314","9.3.9.M0","9.3.9.M1","9.3.9.v20160517","9.4.0.M0","9.4.0.M1","9.4.0.RC0","9.4.0.RC1","9.4.0.RC2","9.4.0.RC3","9.4.0.v20161208","9.4.0.v20180619","9.4.1.v20170120","9.4.1.v20180619","9.4.10.RC0","9.4.10.RC1","9.4.10.v20180503","9.4.11.v20180605","9.4.12.RC0","9.4.12.RC1","9.4.12.RC2","9.4.12.v20180830","9.4.13.v20181111","9.4.14.v20181114","9.4.15.v20190215","9.4.16.v20190411","9.4.17.v20190418","9.4.18.v20190429","9.4.19.v20190610","9.4.2.v20170220","9.4.2.v20180619","9.4.20.v20190813","9.4.21.v20190926","9.4.22.v20191022","9.4.23.v20191118","9.4.24.v20191120","9.4.25.v20191220","9.4.26.v20200117","9.4.27.v20200227","9.4.28.v20200408","9.4.29.v20200521","9.4.3.v20170317","9.4.3.v20180619","9.4.30.v20200611","9.4.31.v20200723","9.4.32.v20200930","9.4.33.v20201020","9.4.34.v20201102","9.4.35.v20201120","9.4.36.v20210114","9.4.37.v20210219","9.4.38.v20210224","9.4.39.v20210325","9.4.4.v20170414","9.4.4.v20180619","9.4.40.v20210413","9.4.5.v20170502","9.4.5.v20180619","9.4.6.v20170531","9.4.6.v20180619","9.4.7.RC0","9.4.7.v20170914","9.4.7.v20180619","9.4.8.v20171121","9.4.8.v20180619","9.4.9.v20180320"]},{"source":"osv","ecosystem":"Maven","package":"org.eclipse.jetty:jetty-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0"},{"fixed":"10.0.3"}]}],"versions":["10.0.0","10.0.1","10.0.2"]},{"source":"osv","ecosystem":"Maven","package":"org.eclipse.jetty:jetty-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0"},{"fixed":"11.0.3"}]}],"versions":["11.0.0","11.0.1","11.0.2"]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"jetty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.15-9.oe1"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.9::el8","package":"coreos-installer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.0-2.rhaos4.9.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.9::el8","package":"coreos-installer-bootinfra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.0-2.rhaos4.9.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.9::el8","package":"coreos-installer-bootinfra-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.0-2.rhaos4.9.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.9::el8","package":"coreos-installer-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.0-2.rhaos4.9.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.9::el8","package":"coreos-installer-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.0-2.rhaos4.9.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.9::el8","package":"jenkins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.289.3.1630554997-1.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.9::el7","package":"openshift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.0-202110080828.p0.git.894a78b.assembly.stream.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.9::el7","package":"openshift-hyperkube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.0-202110080828.p0.git.894a78b.assembly.stream.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.9::el8","package":"openshift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.0-202110080828.p0.git.894a78b.assembly.stream.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.9::el8","package":"openshift-hyperkube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.0-202110080828.p0.git.894a78b.assembly.stream.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.9::el8","package":"network-scripts-openvswitch2.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.15.0-28.el8fdp"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.9::el8","package":"openvswitch2.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.15.0-28.el8fdp"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.9::el8","package":"openvswitch2.15-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.15.0-28.el8fdp"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.9::el8","package":"openvswitch2.15-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.15.0-28.el8fdp"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.9::el8","package":"openvswitch2.15-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.15.0-28.el8fdp"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.9::el8","package":"openvswitch2.15-ipsec","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.15.0-28.el8fdp"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.9::el8","package":"openvswitch2.15-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.15.0-28.el8fdp"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.9::el8","package":"python3-openvswitch2.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.15.0-28.el8fdp"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.9::el8","package":"python3-openvswitch2.15-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.15.0-28.el8fdp"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"jetty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.1.26-1ubuntu1","6.1.26-1ubuntu1.1","6.1.26-1ubuntu1.2"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"jetty8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.1.3-8","8.1.3-9"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"jetty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.1.26-5","6.1.26-5ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"jetty8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.1.17-2","8.1.18-1","8.1.18-2","8.1.18-3","8.1.19-1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.2.14-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.2.22-2","9.2.22-3","9.2.23-1","9.4.15-1~18.04.1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.4.18-2build2","9.4.26-1"]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"eclipse","product":"jetty"},{"vendor":"eclipse foundation","product":"eclipse jetty"},{"vendor":"netapp","product":"active_iq_unified_manager"},{"vendor":"netapp","product":"e-series_santricity_os_controller"},{"vendor":"netapp","product":"e-series_santricity_web_services"},{"vendor":"netapp","product":"element_plug-in_for_vcenter_server"},{"vendor":"netapp","product":"santricity_cloud_connector"},{"vendor":"netapp","product":"snap_creator_framework"},{"vendor":"netapp","product":"snapmanager"},{"vendor":"oracle","product":"autovue_for_agile_product_lifecycle_management"},{"vendor":"oracle","product":"communications_element_manager"},{"vendor":"oracle","product":"communications_services_gatekeeper"},{"vendor":"oracle","product":"communications_session_report_manager"},{"vendor":"oracle","product":"communications_session_route_manager"},{"vendor":"oracle","product":"rest_data_services"},{"vendor":"oracle","product":"siebel_core_-_automation"},{"vendor":"the eclipse foundation","product":"eclipse jetty"}],"references":[{"url":"https://github.com/eclipse/jetty.project/security/advisories/GHSA-m6cp-vxjx-65j6","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","web","article","report"]},{"url":"https://lists.apache.org/thread.html/ref1c161a1621504e673f9197b49e6efe5a33ce3f0e6d8f1f804fc695%40%3Cjira.kafka.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://www.debian.org/security/2021/dsa-4949","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://lists.apache.org/thread.html/rf36f1114e84a3379b20587063686148e2d5a39abc0b8a66ff2a9087a%40%3Cissues.zookeeper.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rddbb4f8d5db23265bb63d14ef4b3723b438abc1589f877db11d35450%40%3Cissues.zookeeper.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r67c4f90658fde875521c949448c54c98517beecdc7f618f902c620ec%40%3Cissues.zookeeper.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://www.oracle.com/security-alerts/cpuoct2021.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://lists.apache.org/thread.html/r8a1a332899a1f92c8118b0895b144b27a78e3f25b9d58a34dd5eb084%40%3Cnotifications.zookeeper.apache.org%3E","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rbefa055282d52d6b58d29a79fbb0be65ab0a38d25f00bd29eaf5e6fd%40%3Cnotifications.zookeeper.apache.org%3E","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://security.netapp.com/advisory/ntap-20210813-0003/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.oracle.com/security-alerts/cpujan2022.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","tags":["x_refsource_MISC","x_transferred","Not Applicable","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-34428","tags":["advisory"]},{"url":"https://lists.apache.org/thread.html/ref1c161a1621504e673f9197b49e6efe5a33ce3f0e6d8f1f804fc695@%3Cjira.kafka.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r67c4f90658fde875521c949448c54c98517beecdc7f618f902c620ec@%3Cissues.zookeeper.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/rddbb4f8d5db23265bb63d14ef4b3723b438abc1589f877db11d35450@%3Cissues.zookeeper.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/rf36f1114e84a3379b20587063686148e2d5a39abc0b8a66ff2a9087a@%3Cissues.zookeeper.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r8a1a332899a1f92c8118b0895b144b27a78e3f25b9d58a34dd5eb084@%3Cnotifications.zookeeper.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/rbefa055282d52d6b58d29a79fbb0be65ab0a38d25f00bd29eaf5e6fd@%3Cnotifications.zookeeper.apache.org%3E","tags":["web"]},{"url":"https://github.com/advisories/GHSA-m6cp-vxjx-65j6"},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-34428","tags":["advisory"]},{"url":"https://github.com/eclipse/jetty.project","tags":["web"]},{"url":"https://security.netapp.com/advisory/ntap-20210813-0003","tags":["web"]},{"url":"https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1263","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:3758","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1965503","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1971016","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1974891","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1984473","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_3758.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-3917","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2018478","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-3917","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3917","tags":["advisory"]},{"url":"https://github.com/coreos/coreos-installer/commit/2a36405339c87b16ed6c76e91ad5b76638fbdb0c","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-28169","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-28169","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-28169","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-33196","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-33196","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-33196","tags":["advisory"]},{"url":"https://groups.google.com/g/golang-announce/c/RgCMkAEQjSI","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-34428","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-34428","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-36980","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-36980","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-36980","tags":["advisory"]},{"url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27851","tags":["article"]},{"url":"https://ubuntu.com/security/CVE-2021-34428","tags":["report"]},{"url":"https://github.com/eclipse/jetty.project/issues/6277","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2021-34428","description":"For Eclipse Jetty versions \u003c= 9.4.40, \u003c= 10.0.2, \u003c= 11.0.2, if an exception is thrown from the SessionListener#sessionDestroyed() method, then the session ID is not invalidated in the session ID manager. On deployments with clustered sessions and multiple contexts this can result in a session not being invalidated. This can result in an application used on a shared computer being left logged in.","status":"published","published":"2021-06-22T14:45:11Z","modified":"2024-08-04T00:12:50.169Z","cvss":[{"version":"3.1","score":2.9,"vector":"CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-613"],"updated_at":"2026-11-02T14:33:11.244759Z"}],"euvd":[{"id":"EUVD-2021-1354","description":"For Eclipse Jetty versions \u003c= 9.4.40, \u003c= 10.0.2, \u003c= 11.0.2, if an exception is thrown from the SessionListener#sessionDestroyed() method, then the session ID is not invalidated in the session ID manager. On deployments with clustered sessions and multiple contexts this can result in a session not being invalidated. This can result in an application used on a shared computer being left logged in.","status":"published","published":"2021-06-22T14:45:11Z","modified":"2024-08-04T00:12:50Z","cvss":[{"version":"3.1","score":2.9,"vector":"CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"low"}],"updated_at":"2026-11-03T03:24:32.445199Z"}],"ghsa":[{"id":"GHSA-m6cp-vxjx-65j6","title":"SessionListener can prevent a session from being invalidated breaking logout","description":"### Impact\nIf an exception is thrown from the `SessionListener#sessionDestroyed()` method, then the session ID is not invalidated in the session ID manager.   On deployments with clustered sessions and multiple contexts this can result in a session not being invalidated.  This can result in an application used on a shared computer being left logged in.\n\nThere is no known path for an attacker to induce such an exception to be thrown, thus they must rely on an application to throw such an exception.    The OP has also identified that during the call to `sessionDestroyed`, the `getLastAccessedTime()` throws an `IllegalStateException`, which potentially contrary to the servlet spec, so applications calling this method may always throw and fail to log out.  If such an application was only tested on a non clustered test environment, then it may be deployed on a clustered environment with multiple contexts and fail to log out.\n\n### Workarounds\nThe application should catch all Throwables within their `SessionListener#sessionDestroyed()` implementations.\n","status":"published","published":"2021-06-23T20:23:04Z","modified":"2023-02-01T05:05:59Z","cvss":[{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"low"}],"cwes":["CWE-613"],"updated_at":"2026-11-02T14:36:36.66596Z"}],"nvd":[{"id":"CVE-2021-34428","description":"For Eclipse Jetty versions \u003c= 9.4.40, \u003c= 10.0.2, \u003c= 11.0.2, if an exception is thrown from the SessionListener#sessionDestroyed() method, then the session ID is not invalidated in the session ID manager. On deployments with clustered sessions and multiple contexts this can result in a session not being invalidated. This can result in an application used on a shared computer being left logged in.","status":"published","published":"2021-06-22T15:15:16.443Z","modified":"2026-06-17T03:55:50.61Z","cvss":[{"version":"3.1","score":2.9,"vector":"CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"low","assessor":"secondary"},{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"low","assessor":"primary"},{"version":"2.0","score":3.6,"vector":"AV:L/AC:L/Au:N/C:P/I:P/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-613"],"updated_at":"2026-11-02T14:06:54.892562Z"}],"osv":[{"id":"CVE-2021-34428","description":"For Eclipse Jetty versions \u003c= 9.4.40, \u003c= 10.0.2, \u003c= 11.0.2, if an exception is thrown from the SessionListener#sessionDestroyed() method, then the session ID is not invalidated in the session ID manager. On deployments with clustered sessions and multiple contexts this can result in a session not being invalidated. This can result in an application used on a shared computer being left logged in.","status":"published","published":"2021-06-22T15:15:16.443Z","modified":"2026-10-24T10:50:41.928014781Z","cvss":[{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T15:44:20.13324Z"},{"id":"DEBIAN-CVE-2021-34428","description":"For Eclipse Jetty versions \u003c= 9.4.40, \u003c= 10.0.2, \u003c= 11.0.2, if an exception is thrown from the SessionListener#sessionDestroyed() method, then the session ID is not invalidated in the session ID manager. On deployments with clustered sessions and multiple contexts this can result in a session not being invalidated. This can result in an application used on a shared computer being left logged in.","status":"published","published":"2021-06-22T15:15:16.443Z","modified":"2026-10-23T18:04:50.612100634Z","cvss":[{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T15:45:35.233346Z"},{"id":"GHSA-m6cp-vxjx-65j6","title":"SessionListener can prevent a session from being invalidated breaking logout","description":"### Impact\nIf an exception is thrown from the `SessionListener#sessionDestroyed()` method, then the session ID is not invalidated in the session ID manager.   On deployments with clustered sessions and multiple contexts this can result in a session not being invalidated.  This can result in an application used on a shared computer being left logged in.\n\nThere is no known path for an attacker to induce such an exception to be thrown, thus they must rely on an application to throw such an exception.    The OP has also identified that during the call to `sessionDestroyed`, the `getLastAccessedTime()` throws an `IllegalStateException`, which potentially contrary to the servlet spec, so applications calling this method may always throw and fail to log out.  If such an application was only tested on a non clustered test environment, then it may be deployed on a clustered environment with multiple contexts and fail to log out.\n\n### Workarounds\nThe application should catch all Throwables within their `SessionListener#sessionDestroyed()` implementations.\n","status":"published","published":"2021-06-23T20:23:04Z","modified":"2026-07-08T06:29:15.047110609Z","cvss":[{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"low"}],"cwes":["CWE-613"],"updated_at":"2026-11-02T15:46:51.463834Z"},{"id":"OESA-2021-1263","title":"jetty security update","description":"Jetty is a 100% Java HTTP Server and Servlet Container. This means that you\\ do not need to configure and run a separate web server (like Apache) in order\\ to use Java, servlets and JSPs to generate dynamic content. Jetty is a fully\\ featured web server for static and dynamic content. Unlike separate\\ server/container solutions, this means that your web server and web\\ application run in the same process, without interconnection overheads\\ and complications. Furthermore, as a pure java component, Jetty can be simply\\ included in your application for demonstration, distribution or deployment.\\ Jetty is available on all Java supported platforms. \\ %global extdesc \\\\ \\ This package contains\r\n\r\nSecurity Fix(es):\r\n\r\nFor Eclipse Jetty versions \u0026lt;= 9.4.40, \u0026lt;= 10.0.2, \u0026lt;= 11.0.2, if an exception is thrown from the SessionListener#sessionDestroyed() method, then the session ID is not invalidated in the session ID manager. On deployments with clustered sessions and multiple contexts this can result in a session not being invalidated. This can result in an application used on a shared computer being left logged in.(CVE-2021-34428)","status":"published","published":"2021-07-10T11:04:30Z","modified":"2026-08-18T01:15:27.395310713Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:38.987987Z"},{"id":"RHSA-2021:3758","title":"Red Hat Security Advisory: OpenShift Container Platform 4.9.0 packages and security update","status":"published","published":"2024-09-30T14:17:53Z","modified":"2026-10-13T10:02:35Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:08.619234Z"},{"id":"UBUNTU-CVE-2021-34428","description":"For Eclipse Jetty versions \u003c= 9.4.40, \u003c= 10.0.2, \u003c= 11.0.2, if an exception is thrown from the SessionListener#sessionDestroyed() method, then the session ID is not invalidated in the session ID manager. On deployments with clustered sessions and multiple contexts this can result in a session not being invalidated. This can result in an application used on a shared computer being left logged in.","status":"published","published":"2021-06-22T15:15:00Z","modified":"2025-10-24T04:50:24Z","cvss":[{"version":"3.1","score":2.9,"vector":"CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"low"},{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T15:54:27.870979Z"},{"id":"CLSA-2026-1768522122","title":"TuxCare security update for org.eclipse.jetty (4 CVEs)","description":"TuxCare rebuilt 2 org.eclipse.jetty packages to address 4 CVEs. Fixed in 8.2.0.v20160908-tuxcare.1.","status":"published","published":"2026-08-04T14:52:07Z","modified":"2026-11-02T19:45:12.459814148Z","updated_at":"2026-11-02T20:30:40.499236Z"},{"id":"CLSA-2026-1790767173","title":"TuxCare security update for 3 packages (2 CVEs)","description":"TuxCare rebuilt 3 packages to address 2 CVEs. Fixed in 9.4.24.v20191120-tuxcare.5.","status":"published","published":"2026-09-30T11:19:33Z","modified":"2026-11-02T19:46:25.961138276Z","updated_at":"2026-11-02T20:29:22.637147Z"},{"id":"DSA-4949-1","title":"jetty9 - security update","status":"published","published":"2021-08-05T00:00:00Z","modified":"2026-03-09T02:10:15.297281Z","updated_at":"2026-11-02T15:46:17.19998Z"}]}}