com.yammer.dropwizard:dropwizard-client (0.2.1), com.yammer.dropwizard:dropwizard-core (0.2.1) +53 more potentially affected by CVE-2021-34428 via org.eclipse.jetty:jetty-server (7.6.1.v20120215)

org.eclipse.jetty:jetty-server MAVEN version 7.6.1.v20120215 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - com.yammer.dropwizard:dropwizard-client 0.2.1 - com.yammer.dropwizard:dropwizard-core 0.2...

com.cibuddy:karaf.assembly (1.0.0), com.github.kaitoy.sneo:giane-jetty (>=1.2.0, <=1.2.3) +117 more potentially affected by CVE-2021-34428 via org.eclipse.jetty:jetty-server (7.6.7.v20120910)

org.eclipse.jetty:jetty-server MAVEN version 7.6.7.v20120910 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - com.cibuddy:karaf.assembly 1.0.0 - com.github.kaitoy.sneo:giane-jetty =1.2.0, =2.0.0-dp1,...

org.eclipse.jetty.aggregate:jetty-all (7.6.0.rc0), org.eclipse.jetty.aggregate:jetty-all-server (7.6.0.rc0) +45 more potentially affected by CVE-2021-34428 via org.eclipse.jetty:jetty-server (7.6.0.rc0)

org.eclipse.jetty:jetty-server MAVEN version 7.6.0.rc0 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - org.eclipse.jetty.aggregate:jetty-all 7.6.0.rc0 - org.eclipse.jetty.aggregate:jetty-all-server...

com.yammer.dropwizard:dropwizard-client (0.1.0), com.yammer.dropwizard:dropwizard-core (0.1.0) +69 more potentially affected by CVE-2021-34428 via org.eclipse.jetty:jetty-server (7.6.0.rc1)

org.eclipse.jetty:jetty-server MAVEN version 7.6.0.rc1 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - com.yammer.dropwizard:dropwizard-client 0.1.0 - com.yammer.dropwizard:dropwizard-core 0.1.0 -...

com.yammer.dropwizard:dropwizard-client (0.1.2), com.yammer.dropwizard:dropwizard-core (0.1.2) +51 more potentially affected by CVE-2021-34428 via org.eclipse.jetty:jetty-server (7.6.0.rc3)

org.eclipse.jetty:jetty-server MAVEN version 7.6.0.rc3 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - com.yammer.dropwizard:dropwizard-client 0.1.2 - com.yammer.dropwizard:dropwizard-core 0.1.2 -...

com.github.jep42:robotframework-easycsvmap-remoteserver (>=0.0.2, <=0.0.5), com.github.jep42:robotframework-formatcompare-remoteserver (>=0.0.2, <=0.0.3) +63 more potentially affected by CVE-2021-34428 via org.eclipse.jetty:jetty-server (7.6.3.v20120416)

org.eclipse.jetty:jetty-server MAVEN version 7.6.3.v20120416 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - com.github.jep42:robotframework-easycsvmap-remoteserver =0.0.2, =0.0.2, =2.0-beta, =0.18,...

net.peachjean.modularwebapp:modularwebapp (1.0.0), org.apache.jena:jena-fuseki (0.2.5) +53 more potentially affected by CVE-2021-34428 via org.eclipse.jetty:jetty-server (7.6.5.v20120716)

org.eclipse.jetty:jetty-server MAVEN version 7.6.5.v20120716 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - net.peachjean.modularwebapp:modularwebapp 1.0.0 - org.apache.jena:jena-fuseki 0.2.5 -...

com.adaptrex:adaptrex-server (0.1.1), com.hmsonline:dropwizard-spring (>=0.1.1, <=0.1.2) +83 more potentially affected by CVE-2021-34428 via org.eclipse.jetty:jetty-server (8.1.4.v20120524)

org.eclipse.jetty:jetty-server MAVEN version 8.1.4.v20120524 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - com.adaptrex:adaptrex-server 0.1.1 - com.hmsonline:dropwizard-spring =0.1.1, =0.20.0,...

com.adaptrex:adaptrex-server (>=0.5.0, <=0.9.12), com.bazaarvoice.dropwizard:dropwizard-configurable-assets-bundle (>=0.1.4, <=0.1.7) +79 more potentially affected by CVE-2021-34428 via org.eclipse.jetty:jetty-server (8.1.5.v20120716)

org.eclipse.jetty:jetty-server MAVEN version 8.1.5.v20120716 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - com.adaptrex:adaptrex-server =0.5.0, =0.1.4, =0.5.1-1, =0.5.1-1, =0.6.0, =0.5.0, =1.1.0,...

org.apache.asterix:asterix-app (0.8.8-incubating), org.apache.clerezza:platform.launcher.storageless (0.8-incubating) +80 more potentially affected by CVE-2021-34428 via org.eclipse.jetty:jetty-server (8.0.0.m2)

org.eclipse.jetty:jetty-server MAVEN version 8.0.0.m2 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - org.apache.asterix:asterix-app 0.8.8-incubating -...

br.com.caelum.vraptor:vraptor-test (1.0.0), net.javacrumbs:mock-socket-http (>=0.1, <=0.6) +18 more potentially affected by CVE-2021-34428 via org.eclipse.jetty:jetty-server (7.0.0.m2)

org.eclipse.jetty:jetty-server MAVEN version 7.0.0.m2 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - br.com.caelum.vraptor:vraptor-test 1.0.0 - net.javacrumbs:mock-socket-http =0.1, =0.6 -...

com.github.rest-driver:rest-client-driver (>=1.1.11, <=1.1.14), io.opentelemetry.javaagent:opentelemetry-testing-common (>=0.15.0, <=1.2.0-alpha) +41 more potentially affected by CVE-2021-34428 via org.eclipse.jetty:jetty-server (8.0.0.v20110901)

org.eclipse.jetty:jetty-server MAVEN version 8.0.0.v20110901 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - com.github.rest-driver:rest-client-driver =1.1.11, =0.15.0, =1.2.0-alpha -...

com.jolira:testing-tools (1.2.5), org.apache.geronimo.assemblies:geronimo-jetty7-javaee5 (2.2.1) +155 more potentially affected by CVE-2021-34428 via org.eclipse.jetty:jetty-server (7.2.1.v20101111)

org.eclipse.jetty:jetty-server MAVEN version 7.2.1.v20101111 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - com.jolira:testing-tools 1.2.5 - org.apache.geronimo.assemblies:geronimo-jetty7-javaee5...

org.eclipse.jetty.aggregate:jetty-all (7.1.0.rc1), org.eclipse.jetty.aggregate:jetty-all-server (7.1.0.rc1) +33 more potentially affected by CVE-2021-34428 via org.eclipse.jetty:jetty-server (7.1.0.rc1)

org.eclipse.jetty:jetty-server MAVEN version 7.1.0.rc1 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - org.eclipse.jetty.aggregate:jetty-all 7.1.0.rc1 - org.eclipse.jetty.aggregate:jetty-all-server...

CVE-2021-34428

A flaw was discovered in the jetty-server, where if an exception is thrown from the SessionListenersessionDestroyed method, then the session ID is not invalidated in the session ID manager. On deployments with clustered sessions and multiple contexts, this could result in a session not being...

DEBIAN-CVE-2021-34428

For Eclipse Jetty versions = 9.4.40, = 10.0.2, = 11.0.2, if an exception is thrown from the SessionListenersessionDestroyed method, then the session ID is not invalidated in the session ID manager. On deployments with clustered sessions and multiple contexts this can result in a session not being...

com.aspectran:aspectran-with-jetty (>=7.0.0, <=7.0.3), com.github.gv2011:http (>=0.6, <=0.8) +112 more potentially affected by CVE-2021-34428 via org.eclipse.jetty:jetty-server (>=11.0.0, <=11.0.2)

org.eclipse.jetty:jetty-server MAVEN version =11.0.0, =7.0.0, =0.6, =0.6, =2.0.2, =2.0.0, =1.0, =1.0, =1.0, =1.0, =5.0.0-rc4, =4.2.0-beta.1, =0.0.31, =3.0.5, =4.2.6 and more Source cves: CVE-2021-34428 Source advisory: MEND:CVE-2021-34428...

com.bolyartech.ezlambda:ezlambda-server (1.1.1), com.bolyartech.forge.server:forge-server-jetty (>=9.1.3, <=10.0.2) +84 more potentially affected by CVE-2021-34428 via org.eclipse.jetty:jetty-server (>=10.0.0, <=10.0.2)

org.eclipse.jetty:jetty-server MAVEN version =10.0.0, =9.1.3, =2.33, =2.33, =2.33, =1.3.6, =1.0.0, =1.0.0, =1.0.0, =5.0.0-rc4, =5.0.0-rc5 and more Source cves: CVE-2021-34428 Source advisory: MEND:CVE-2021-34428...

jetty: Ambiguous paths can access WEB-INF

In Jetty the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF directory. An attacker can use this vulnerability to reveal sensitive information regarding the implementation of a web application...

jetty: Resource exhaustion when receiving an invalid large TLS frame

When using SSL/TLS with Jetty, either with HTTP/1.1, HTTP/2, or WebSocket, the server may receive an invalid large greater than 17408 TLS frame that is incorrectly handled, causing high CPU resources utilization. The highest threat from this vulnerability is to service availability...