Skip to content
OpenAdvisories
Low ALAS2-2025-2855 1 CVE

Low: jetty security update (Amazon Linux 2)

Published May 8, 2025 · Updated May 13, 2025

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-34428: For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, if an exception is thrown from the SessionListener#sessionDestroyed() method, then the session ID is not invalidated in the session ID manager. On deployments with clustered sessions and multiple contexts this can result in a session not being invalidated. This can result in an application used on a shared computer being left logged in.

Fixed packages 36

ReleasePackageFixed in
Amazon Linux · 2 jetty-annotations 0:9.0.3-8.amzn2.0.5
Amazon Linux · 2 jetty-ant 0:9.0.3-8.amzn2.0.5
Amazon Linux · 2 jetty-client 0:9.0.3-8.amzn2.0.5
Amazon Linux · 2 jetty-continuation 0:9.0.3-8.amzn2.0.5
Amazon Linux · 2 jetty-deploy 0:9.0.3-8.amzn2.0.5
Amazon Linux · 2 jetty-http 0:9.0.3-8.amzn2.0.5
Amazon Linux · 2 jetty-io 0:9.0.3-8.amzn2.0.5
Amazon Linux · 2 jetty-jaas 0:9.0.3-8.amzn2.0.5
Amazon Linux · 2 jetty-jaspi 0:9.0.3-8.amzn2.0.5
Amazon Linux · 2 jetty-javadoc 0:9.0.3-8.amzn2.0.5
Amazon Linux · 2 jetty-jmx 0:9.0.3-8.amzn2.0.5
Amazon Linux · 2 jetty-jndi 0:9.0.3-8.amzn2.0.5
Amazon Linux · 2 jetty-jsp 0:9.0.3-8.amzn2.0.5
Amazon Linux · 2 jetty-jspc-maven-plugin 0:9.0.3-8.amzn2.0.5
Amazon Linux · 2 jetty-maven-plugin 0:9.0.3-8.amzn2.0.5
Amazon Linux · 2 jetty-monitor 0:9.0.3-8.amzn2.0.5
Amazon Linux · 2 jetty-plus 0:9.0.3-8.amzn2.0.5
Amazon Linux · 2 jetty-project 0:9.0.3-8.amzn2.0.5
Amazon Linux · 2 jetty-proxy 0:9.0.3-8.amzn2.0.5
Amazon Linux · 2 jetty-rewrite 0:9.0.3-8.amzn2.0.5
Amazon Linux · 2 jetty-runner 0:9.0.3-8.amzn2.0.5
Amazon Linux · 2 jetty-security 0:9.0.3-8.amzn2.0.5
Amazon Linux · 2 jetty-server 0:9.0.3-8.amzn2.0.5
Amazon Linux · 2 jetty-servlet 0:9.0.3-8.amzn2.0.5
Amazon Linux · 2 jetty-servlets 0:9.0.3-8.amzn2.0.5
Amazon Linux · 2 jetty-start 0:9.0.3-8.amzn2.0.5
Amazon Linux · 2 jetty-util 0:9.0.3-8.amzn2.0.5
Amazon Linux · 2 jetty-util-ajax 0:9.0.3-8.amzn2.0.5
Amazon Linux · 2 jetty-webapp 0:9.0.3-8.amzn2.0.5
Amazon Linux · 2 jetty-websocket-api 0:9.0.3-8.amzn2.0.5
Amazon Linux · 2 jetty-websocket-client 0:9.0.3-8.amzn2.0.5
Amazon Linux · 2 jetty-websocket-common 0:9.0.3-8.amzn2.0.5
Amazon Linux · 2 jetty-websocket-parent 0:9.0.3-8.amzn2.0.5
Amazon Linux · 2 jetty-websocket-server 0:9.0.3-8.amzn2.0.5
Amazon Linux · 2 jetty-websocket-servlet 0:9.0.3-8.amzn2.0.5
Amazon Linux · 2 jetty-xml 0:9.0.3-8.amzn2.0.5

Vulnerabilities 1

  • Low 2.9
    CVE-2021-34428 Public exploit

    SessionListener can prevent a session from being invalidated breaking logout

    For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, if an exception is thrown from the SessionListener#sessionDestroyed() method, then the session ID is not invalidated in the session ID manager. On deployments with clustered sessions and multiple con…

    The Eclipse Foundation Eclipse Jetty jetty9 jetty9 Debian Ubuntu Maven

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-34428.html