Description
Jetty before 4.2.27, 5.1 before 5.1.12, 6.0 before 6.0.2, and 6.1 before 6.1.0pre3 generates predictable session identifiers using java.util.random, which makes it easier for remote attackers to guess a session identifier through brute force attacks, bypass authentication requirements, and possibly conduct cross-site request forgery attacks.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.eclipse.jetty:jetty-server | < 4.2.27 | 4.2.27 | GHSA-jg2x-r643-w2ch |
| Maven | org.eclipse.jetty:jetty-server | >= 5.1.0, < 5.1.12 | 5.1.12 | GHSA-jg2x-r643-w2ch |
| Maven | org.eclipse.jetty:jetty-server | >= 6.0.0, < 6.0.2 | 6.0.2 | GHSA-jg2x-r643-w2ch |
| Maven | org.eclipse.jetty:jetty-server | >= 6.1.0pre1, < 6.1.0pre3 | 6.1.0pre3 | GHSA-jg2x-r643-w2ch |
References
- 24070 third-party-advisory
- ADV-2007-0497 vdb-entry
- jetty-sessionid-session-hijacking(32240) vdb-entry
- 33108 vdb-entry
- 22405 vdb-entry
- http://fisheye.codehaus.org/changelog/jetty/?cs=1274
- 20070206 Re: Jetty Session ID Prediction mailing-list
- 20070205 Jetty Session ID Prediction mailing-list