Most recent entries from all

bdu:2023-06394

certfr-2024-avi-0031 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan…

certfr-2024-avi-0031

Withdrawn: CLEANSTART-2026-IF26545 — Security fixes in apache-hive 4.0.1-r1

Withdrawn by the publisher.

Affected: CleanStart: apache-hive

Package apache-hive version 4.0.1-r1 fixes 27 vulnerabilities: CVE-2024-47561, CVE-2024-7254, CVE-2024-47554, CVE-2022-41881, CVE-2023-34462...

EUVD-2026-216795

fkie_cve-2023-41900

Jetty is a Java based web server and servlet engine. Versions 9.4.21 through 9.4.51, 10.0.15, and 11.0.15 are vulnerable to weak authentication. If a Jetty `OpenIdAuthenticator` uses the optional nested `LoginService`, and that `LoginService` decides to revoke an already authenticated user, then the current request will still treat the user as authenticated. The authentication is then cleared from the session and subsequent requests will not be treated as authenticated. So a request on a previously authenticated session could be allowed to bypass authentication after it had been rejected by the `LoginService`. This impacts usages of the jetty-openid which have configured a nested `LoginService` and where that `LoginService` will is capable of rejecting previously authenticated users. Versions 9.4.52, 10.0.16, and 11.0.16 have a patch for this issue.

GHSA-pwh8-58vv-vw48 — Jetty's OpenId Revoked authentication allows one request

Affected: Maven: org.eclipse.jetty:jetty-openid

If a Jetty `OpenIdAuthenticator` uses the optional nested `LoginService`, and that `LoginService` decides to revoke an already authenticated user, then the current request will still treat the user as authenticated. The authentication is then cleared from the session and subsequent requests will not be treated as authenticated.

So a request on a previously authenticated session could be allowed to bypass authentication after it had been rejected by the `LoginService`.

### Impact This impacts usages of the jetty-openid which have configured a nested `LoginService` and where that `LoginService` will is capable of rejecting previously authenticated users.

### Original Report > working on a custom OpenIdAuthenticator, I discovered the following: > > https://github.com/eclipse/jetty.project/blob/jetty-10.0.14/jetty-openid/src/main/java/org/eclipse/jetty/security/openid/OpenIdAuthenticator.java#L505 > > In the case where the LoginService does return that the authentication has been revoked (from the validate() call on line 463), the OpenIdAuthenticator removes the authentication from the session; however the current request still proceeds as if authenticated, since it falls through to "return authentication" on line 505. > > This is fixed by moving the line 505 (and associated debug log) inside the else block that ends on line 502, instead of outside it. Then the revocation case will run through to line 517 and will trigger a new OpenId authentication which I think is corre…

gsd-2023-41900

openSUSE-SU-2024:13329-1 — jetty-annotations-9.4.53-1.1 on GA media

jetty-annotations-9.4.53-1.1 on GA media

RHSA-2023:7247 — Red Hat Security Advisory: Red Hat Fuse 7.12.1 release and security update

undertow: OutOfMemoryError due to @MultipartConfig handling okio: GzipSource class improper exception handling spring-security-webflux: path wildcard leads to security bypass jetty: hpack header values cause denial of service in http/2 jetty: Improper addition of quotation marks to user inputs in CgiServlet apache-avro: Apache Avro Java SDK: Memory when deserializing untrusted data in Avro Java SDK jetty: Improper validation of HTTP/1 content-length jetty: OpenId Revoked authentication allows one request tomcat: FileUpload: DoS due to accumulation of temporary files on Windows tomcat: improper cleaning of recycled objects could lead to information leak HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) tomcat: incorrectly parsed http trailer headers can cause request smuggling activemq-openwire: OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack

UBUNTU-CVE-2023-41900

Affected: Ubuntu:16.04:LTS: jetty9, Ubuntu:18.04:LTS: jetty9, Ubuntu:20.04:LTS: jetty9, Ubuntu:22.04:LTS: jetty9

WID-SEC-W-2023-2359 — Eclipse Jetty: Mehrere Schwachstellen

Ein entfernter authentifizierter Angreifer kann mehrere Schwachstellen in Eclipse Jetty ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen oder einen HTTP-Cache-Poison-Angriff durchzuführen.