Bug 1184366 - (CVE-2021-28163) VUL-0: CVE-2021-28163: jetty-minimal: leak of the contents of the webapps directory when is deployed as a static webapp
(CVE-2021-28163)
VUL-0: CVE-2021-28163: jetty-minimal: leak of the contents of the webapps dir...
Status: RESOLVED FIXED
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents
unspecified
Other Other
: P3 - Medium : Normal
: ---
Assigned To: Fridrich Strba
Security Team bot
https://smash.suse.de/issue/280890/
CVSSv3.1:SUSE:CVE-2021-28163:5.9:(AV:...
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2021-04-06 10:56 UTC by Alexandros Toptsoglou
Modified: 2022-04-07 09:50 UTC (History)
1 user (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Alexandros Toptsoglou 2021-04-06 10:56:26 UTC
CVE-2021-28163

In Eclipse Jetty 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to
11.0.1, if a user uses a webapps directory that is a symlink, the contents of
the webapps directory is deployed as a static webapp, inadvertently serving the
webapps themselves and anything else that might be in that directory.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-28163
https://access.redhat.com/security/cve/CVE-2021-28163
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28163
https://github.com/eclipse/jetty.project/security/advisories/GHSA-j6qj-j888-vvgq
Comment 1 Alexandros Toptsoglou 2021-04-06 10:56:55 UTC
Tracked SLE15-SP2 as affected.
Comment 3 Swamp Workflow Management 2021-06-17 19:27:50 UTC
SUSE-SU-2021:2005-1: An update that fixes four vulnerabilities is now available.

Category: security (important)
Bug References: 1184366,1184367,1184368,1187117
CVE References: CVE-2021-28163,CVE-2021-28164,CVE-2021-28165,CVE-2021-28169
JIRA References: 
Sources used:
SUSE Linux Enterprise Module for Development Tools 15-SP3 (src):    jetty-minimal-9.4.42-3.9.1
SUSE Linux Enterprise Module for Development Tools 15-SP2 (src):    jetty-minimal-9.4.42-3.9.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 4 Swamp Workflow Management 2021-07-11 13:23:56 UTC
openSUSE-SU-2021:2005-1: An update that fixes four vulnerabilities is now available.

Category: security (important)
Bug References: 1184366,1184367,1184368,1187117
CVE References: CVE-2021-28163,CVE-2021-28164,CVE-2021-28165,CVE-2021-28169
JIRA References: 
Sources used:
openSUSE Leap 15.3 (src):    jetty-minimal-9.4.42-3.9.1, jetty-websocket-9.4.42-3.9.1
Comment 5 Fridrich Strba 2022-04-07 09:50:33 UTC
fixed