Security update for jetty-minimal SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2021:2838-1 Final 1 1 2021-08-25T10:34:13Z current 2021-08-25T10:34:13Z 2021-08-25T10:34:13Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for jetty-minimal This update for jetty-minimal fixes the following issues: - Update to version 9.4.43.v20210629 - CVE-2021-34429: URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and/or bypass some security constraints. (bsc#1188438) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2021-2838,SUSE-SLE-Module-Development-Tools-15-SP2-2021-2838,SUSE-SLE-Module-Development-Tools-15-SP3-2021-2838 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2021/suse-su-20212838-1/ Link for SUSE-SU-2021:2838-1 https://lists.suse.com/pipermail/sle-security-updates/2021-August/009354.html E-Mail link for SUSE-SU-2021:2838-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1188438 SUSE Bug 1188438 https://www.suse.com/security/cve/CVE-2021-34429/ SUSE CVE CVE-2021-34429 page SUSE Linux Enterprise Module for Development Tools 15 SP2 SUSE Linux Enterprise Module for Development Tools 15 SP3 jetty-annotations-9.4.43-3.12.2 jetty-ant-9.4.43-3.12.2 jetty-cdi-9.4.43-3.12.2 jetty-client-9.4.43-3.12.2 jetty-continuation-9.4.43-3.12.2 jetty-deploy-9.4.43-3.12.2 jetty-fcgi-9.4.43-3.12.2 jetty-http-9.4.43-3.12.2 jetty-http-spi-9.4.43-3.12.2 jetty-io-9.4.43-3.12.2 jetty-jaas-9.4.43-3.12.2 jetty-javax-websocket-client-impl-9.4.43-3.12.2 jetty-javax-websocket-server-impl-9.4.43-3.12.2 jetty-jmx-9.4.43-3.12.2 jetty-jndi-9.4.43-3.12.2 jetty-jsp-9.4.43-3.12.2 jetty-minimal-javadoc-9.4.43-3.12.2 jetty-openid-9.4.43-3.12.2 jetty-plus-9.4.43-3.12.2 jetty-proxy-9.4.43-3.12.2 jetty-quickstart-9.4.43-3.12.2 jetty-rewrite-9.4.43-3.12.2 jetty-security-9.4.43-3.12.2 jetty-server-9.4.43-3.12.2 jetty-servlet-9.4.43-3.12.2 jetty-servlets-9.4.43-3.12.2 jetty-start-9.4.43-3.12.2 jetty-util-9.4.43-3.12.2 jetty-util-ajax-9.4.43-3.12.2 jetty-webapp-9.4.43-3.12.2 jetty-websocket-api-9.4.43-3.12.2 jetty-websocket-client-9.4.43-3.12.2 jetty-websocket-common-9.4.43-3.12.2 jetty-websocket-javadoc-9.4.43-3.12.2 jetty-websocket-server-9.4.43-3.12.2 jetty-websocket-servlet-9.4.43-3.12.2 jetty-xml-9.4.43-3.12.2 jetty-http-9.4.43-3.12.2 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP2 jetty-io-9.4.43-3.12.2 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP2 jetty-security-9.4.43-3.12.2 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP2 jetty-server-9.4.43-3.12.2 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP2 jetty-servlet-9.4.43-3.12.2 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP2 jetty-util-9.4.43-3.12.2 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP2 jetty-util-ajax-9.4.43-3.12.2 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP2 jetty-http-9.4.43-3.12.2 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP3 jetty-io-9.4.43-3.12.2 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP3 jetty-security-9.4.43-3.12.2 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP3 jetty-server-9.4.43-3.12.2 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP3 jetty-servlet-9.4.43-3.12.2 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP3 jetty-util-9.4.43-3.12.2 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP3 jetty-util-ajax-9.4.43-3.12.2 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP3 For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and/or bypass some security constraints. This is a variation of the vulnerability reported in CVE-2021-28164/GHSA-v7ff-8wcx-gmc5. CVE-2021-34429 SUSE Linux Enterprise Module for Development Tools 15 SP2:jetty-http-9.4.43-3.12.2 SUSE Linux Enterprise Module for Development Tools 15 SP2:jetty-io-9.4.43-3.12.2 SUSE Linux Enterprise Module for Development Tools 15 SP2:jetty-security-9.4.43-3.12.2 SUSE Linux Enterprise Module for Development Tools 15 SP2:jetty-server-9.4.43-3.12.2 SUSE Linux Enterprise Module for Development Tools 15 SP2:jetty-servlet-9.4.43-3.12.2 SUSE Linux Enterprise Module for Development Tools 15 SP2:jetty-util-9.4.43-3.12.2 SUSE Linux Enterprise Module for Development Tools 15 SP2:jetty-util-ajax-9.4.43-3.12.2 SUSE Linux Enterprise Module for Development Tools 15 SP3:jetty-http-9.4.43-3.12.2 SUSE Linux Enterprise Module for Development Tools 15 SP3:jetty-io-9.4.43-3.12.2 SUSE Linux Enterprise Module for Development Tools 15 SP3:jetty-security-9.4.43-3.12.2 SUSE Linux Enterprise Module for Development Tools 15 SP3:jetty-server-9.4.43-3.12.2 SUSE Linux Enterprise Module for Development Tools 15 SP3:jetty-servlet-9.4.43-3.12.2 SUSE Linux Enterprise Module for Development Tools 15 SP3:jetty-util-9.4.43-3.12.2 SUSE Linux Enterprise Module for Development Tools 15 SP3:jetty-util-ajax-9.4.43-3.12.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-20212838-1/ https://www.suse.com/security/cve/CVE-2021-34429.html CVE-2021-34429 https://bugzilla.suse.com/1188438 SUSE Bug 1188438