p PatchFirst

CVE-2021-34429

CVE-2021-34429

This page contains facts from public vulnerability sources. Check the original advisory before updating.

This page shows selected source facts. See the linked advisories for the complete description and affected versions.

For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and/or bypass some security constraints. This is a variation of the vulnerability reported in CVE-2021-28164/GHSA-v7ff-8wcx-gmc5.

CVSS 5.3 · Medium · EPSS 99.3% · Public exploit · Fix available

Published
Updated

Stack: system

Affected products and versions

  • eclipse jetty

    Versions
    • ≥ 9.4.37, < unspecified: Affected (custom)
    • ≥ unspecified, ≤ 9.4.42: Affected (custom)
    • ≥ 10.0.1, < unspecified: Affected (custom)
    • ≥ unspecified, ≤ 10.0.5: Affected (custom)
    • ≥ 11.0.1, < unspecified: Affected (custom)
    • ≥ unspecified, ≤ 11.0.5: Affected (custom)

    No fix published

  • jetty9 Debian:12

    Affected ranges
    • ECOSYSTEM: < 9.4.39-3

    Update to 9.4.39-3

  • jetty9 Debian:13

    Affected ranges
    • ECOSYSTEM: < 9.4.39-3

    Update to 9.4.39-3

  • jetty9 Debian:14

    Affected ranges
    • ECOSYSTEM: < 9.4.39-3

    Update to 9.4.39-3

  • jetty9 Ubuntu:16.04:LTS

    Versions
    • 9.2.14-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • jetty9 Ubuntu:22.04:LTS

    Versions
    • 9.4.39-3
    • 9.4.44-2
    • 9.4.44-3
    • 9.4.44-4
    • 9.4.45-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →