CVE-2021-34428 SessionListener can prevent a session from being invalidated breaking logout
Attackers can maintain unauthorized access on shared computers if session invalidation fails due to exceptions in clustered Jetty deployments.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2021-34428?
CVE-2021-34428 is a low-severity authentication bypass vulnerability in Debian Debian Linux, published on 22 Jun 2021. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, if an exception is thrown from the SessionListener#sessionDestroyed() method, then the session ID is not invalidated in the session ID manager. On deployments with clustered sessions and multiple contexts this can result in a session not being invalidated. This can result in an application used on a shared computer being left logged in.
Weakness: CWE-613
Which versions are affected by CVE-2021-34428?
6 open source packages ship an affected version, including org.eclipse.jetty:jetty-server. It affects 16 products.
| Package | Affected | Fixed in |
|---|---|---|
org.eclipse.jetty:jetty-server Maven | All versions | 9.4.41 |
org.eclipse.jetty:jetty-server Maven | All versions | 9.4.41 |
org.eclipse.jetty:jetty-server Maven | From 10.0.0 | 10.0.3 |
org.eclipse.jetty:jetty-server Maven | From 10.0.0 | 10.0.3 |
org.eclipse.jetty:jetty-server Maven | From 11.0.0 | 11.0.3 |
org.eclipse.jetty:jetty-server Maven | From 11.0.0 | 11.0.3 |
Products include Debian Debian Linux, Eclipse Jetty, Netapp Active Iq Unified Manager, Netapp E-Series Santricity Os Controller, Netapp E-Series Santricity Web Services, Netapp Element Plug-in for Vcenter Server and 10 more.
How do I fix CVE-2021-34428?
Upgrade org.eclipse.jetty:jetty-server to a fixed version for your release line: 9.4.41, 10.0.3 or 11.0.3.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2021-34428 being exploited?
There is no known exploitation of CVE-2021-34428 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as CLEANSTART-2026-IJ78977, DEBIAN-CVE-2021-34428, GHSA-m6cp-vxjx-65j6, OESA-2021-1263, UBUNTU-CVE-2021-34428.