Insufficient Session Expiration The advisory has been revoked - it doesn't affect any version of package jetty-http (opens in a new tab)

Threat Intelligence

0.96% (57^th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk IDSNYK-RHEL8-JETTYHTTP-1361502
published26 Jul 2021
disclosed22 Jun 2021

Report a new vulnerability Found a mistake?

Introduced: 22 Jun 2021

CVE-2021-34428 (opens in a new tab) CWE-613 (opens in a new tab)

Amendment

The Red Hat security team deemed this advisory irrelevant for RHEL:8.

NVD Description

Note: Versions mentioned in the description apply only to the upstream jetty-http package and not the jetty-http package as distributed by RHEL.

For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, if an exception is thrown from the SessionListener#sessionDestroyed() method, then the session ID is not invalidated in the session ID manager. On deployments with clustered sessions and multiple contexts this can result in a session not being invalidated. This can result in an application used on a shared computer being left logged in.