Bugzilla – Bug 1215416
VUL-0: CVE-2023-41900: jetty-websocket,jetty-minimal: OpenId Revoked authentication allows one request
Last modified: 2024-03-05 09:20:46 UTC
CVE-2023-41900 Jetty is a Java based web server and servlet engine. Versions 9.4.21 through 9.4.51, 10.0.15, and 11.0.15 are vulnerable to weak authentication. If a Jetty `OpenIdAuthenticator` uses the optional nested `LoginService`, and that `LoginService` decides to revoke an already authenticated user, then the current request will still treat the user as authenticated. The authentication is then cleared from the session and subsequent requests will not be treated as authenticated. So a request on a previously authenticated session could be allowed to bypass authentication after it had been rejected by the `LoginService`. This impacts usages of the jetty-openid which have configured a nested `LoginService` and where that `LoginService` will is capable of rejecting previously authenticated users. Versions 9.4.52, 10.0.16, and 11.0.16 have a patch for this issue. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-41900 https://www.cve.org/CVERecord?id=CVE-2023-41900 https://github.com/eclipse/jetty.project/pull/9528 https://github.com/eclipse/jetty.project/pull/9660 https://github.com/eclipse/jetty.project/security/advisories/GHSA-pwh8-58vv-vw48
SUSE-SU-2023:4210-1: An update that solves five vulnerabilities can now be installed. Category: security (important) Bug References: 1215415, 1215416, 1215417, 1216162, 1216169 CVE References: CVE-2023-36478, CVE-2023-36479, CVE-2023-40167, CVE-2023-41900, CVE-2023-44487 Sources used: SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (src): jetty-minimal-9.4.53-150200.3.22.1 SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (src): jetty-minimal-9.4.53-150200.3.22.1 SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (src): jetty-minimal-9.4.53-150200.3.22.1 SUSE Linux Enterprise Server for SAP Applications 15 SP2 (src): jetty-minimal-9.4.53-150200.3.22.1 SUSE Linux Enterprise Server for SAP Applications 15 SP3 (src): jetty-minimal-9.4.53-150200.3.22.1 SUSE Enterprise Storage 7.1 (src): jetty-minimal-9.4.53-150200.3.22.1 openSUSE Leap 15.4 (src): jetty-minimal-9.4.53-150200.3.22.1 openSUSE Leap 15.5 (src): jetty-minimal-9.4.53-150200.3.22.1 Development Tools Module 15-SP4 (src): jetty-minimal-9.4.53-150200.3.22.1 Development Tools Module 15-SP5 (src): jetty-minimal-9.4.53-150200.3.22.1 SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (src): jetty-minimal-9.4.53-150200.3.22.1 SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 (src): jetty-minimal-9.4.53-150200.3.22.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Fixed, please close.