Skip to content
OpenAdvisories
Medium ALAS2-2024-2408 1 CVE

Moderate: jetty security update (Amazon Linux 2)

Published Jan 3, 2024 · Updated Jan 9, 2024

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-28169: For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory. For example a request to `/concat?/%2557EB-INF/web.xml` can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.

Fixed packages 36

ReleasePackageFixed in
Amazon Linux · 2 jetty-annotations 0:9.0.3-8.amzn2.0.1
Amazon Linux · 2 jetty-ant 0:9.0.3-8.amzn2.0.1
Amazon Linux · 2 jetty-client 0:9.0.3-8.amzn2.0.1
Amazon Linux · 2 jetty-continuation 0:9.0.3-8.amzn2.0.1
Amazon Linux · 2 jetty-deploy 0:9.0.3-8.amzn2.0.1
Amazon Linux · 2 jetty-http 0:9.0.3-8.amzn2.0.1
Amazon Linux · 2 jetty-io 0:9.0.3-8.amzn2.0.1
Amazon Linux · 2 jetty-jaas 0:9.0.3-8.amzn2.0.1
Amazon Linux · 2 jetty-jaspi 0:9.0.3-8.amzn2.0.1
Amazon Linux · 2 jetty-javadoc 0:9.0.3-8.amzn2.0.1
Amazon Linux · 2 jetty-jmx 0:9.0.3-8.amzn2.0.1
Amazon Linux · 2 jetty-jndi 0:9.0.3-8.amzn2.0.1
Amazon Linux · 2 jetty-jsp 0:9.0.3-8.amzn2.0.1
Amazon Linux · 2 jetty-jspc-maven-plugin 0:9.0.3-8.amzn2.0.1
Amazon Linux · 2 jetty-maven-plugin 0:9.0.3-8.amzn2.0.1
Amazon Linux · 2 jetty-monitor 0:9.0.3-8.amzn2.0.1
Amazon Linux · 2 jetty-plus 0:9.0.3-8.amzn2.0.1
Amazon Linux · 2 jetty-project 0:9.0.3-8.amzn2.0.1
Amazon Linux · 2 jetty-proxy 0:9.0.3-8.amzn2.0.1
Amazon Linux · 2 jetty-rewrite 0:9.0.3-8.amzn2.0.1
Amazon Linux · 2 jetty-runner 0:9.0.3-8.amzn2.0.1
Amazon Linux · 2 jetty-security 0:9.0.3-8.amzn2.0.1
Amazon Linux · 2 jetty-server 0:9.0.3-8.amzn2.0.1
Amazon Linux · 2 jetty-servlet 0:9.0.3-8.amzn2.0.1
Amazon Linux · 2 jetty-servlets 0:9.0.3-8.amzn2.0.1
Amazon Linux · 2 jetty-start 0:9.0.3-8.amzn2.0.1
Amazon Linux · 2 jetty-util 0:9.0.3-8.amzn2.0.1
Amazon Linux · 2 jetty-util-ajax 0:9.0.3-8.amzn2.0.1
Amazon Linux · 2 jetty-webapp 0:9.0.3-8.amzn2.0.1
Amazon Linux · 2 jetty-websocket-api 0:9.0.3-8.amzn2.0.1
Amazon Linux · 2 jetty-websocket-client 0:9.0.3-8.amzn2.0.1
Amazon Linux · 2 jetty-websocket-common 0:9.0.3-8.amzn2.0.1
Amazon Linux · 2 jetty-websocket-parent 0:9.0.3-8.amzn2.0.1
Amazon Linux · 2 jetty-websocket-server 0:9.0.3-8.amzn2.0.1
Amazon Linux · 2 jetty-websocket-servlet 0:9.0.3-8.amzn2.0.1
Amazon Linux · 2 jetty-xml 0:9.0.3-8.amzn2.0.1

Vulnerabilities 1

  • Medium 5.3
    CVE-2021-28169 Scanner template EPSS 78%

    Jetty Utility Servlets ConcatServlet Double Decoding Information Disclosure Vulnerability

    For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory. For example a request to `/concat?/%2557EB-INF/web.xml` can ret…

    The Eclipse Foundation Eclipse Jetty jetty9 jetty9 Debian Ubuntu Maven

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-28169.html