CVE-2021-34429

For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and/or bypass some security constraints. This is a variation of the vulnerability reported in CVE-2021-28164/GHSA-v7ff-8wcx-gmc5.

References

Affected packages

Git / github.com/jetty/jetty.project

Affected ranges

Type

GIT

Repo

https://github.com/jetty/jetty.project

Events

Introduced

27afab2bd37780d179836e313e0fe11bc4fa0ce9

Fixed

526006ecfa3af7f1a27ef3a288e2bef7ea9dd7e8

Introduced

d0bfd9145ddac13b73e98b2637fcbf4a48132397

Fixed

37e7731b4b142a882d73974ff3bec78d621bd674

Introduced

e98092c1791fbda9d157dd5339cf3a909e90ab40

Fixed

69469432898becda3aed32a32d4b0adbb7b6daee

Database specific

{
    "versions": [
        {
            "introduced": "9.4.37"
        },
        {
            "fixed": "9.4.43"
        },
        {
            "introduced": "10.0.1"
        },
        {
            "fixed": "10.0.6"
        },
        {
            "introduced": "11.0.1"
        },
        {
            "fixed": "11.0.6"
        }
    ]
}

Affected versions

jetty-10.*

jetty-10.0.0

jetty-10.0.0-alpha0

jetty-10.0.0.alpha1

jetty-10.0.0.beta1

jetty-10.0.0.beta2

jetty-10.0.0.beta3

jetty-10.0.1

jetty-10.0.2

jetty-10.0.4

jetty-10.0.5

jetty-9.*

jetty-9.4.37.v20210219

jetty-9.4.38.v20210224

jetty-9.4.39.v20210325

jetty-9.4.40.v20210413

jetty-9.4.42.v20210604

Database specific

unresolved_ranges

[
    {
        "events": [
            {
                "introduced": "11.0"
            },
            {
                "last_affected": "11.70.1"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "21.0.2"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "1.10.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "1.5.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "1.14.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "1.14.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "8.0.0.0"
            },
            {
                "last_affected": "8.5.0.2"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "8.0.8.2.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "8.0.8.3.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "fixed": "22.1.1"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "20.0.1"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "fixed": "19.1.0.0.6.4"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "19c"
            }
        ]
    }
]

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-34429.json"