Vulnerability · Published Sep 15, 2023 · Assigned by GitHub_M
CVE-2023-41900Jetty's OpenId Revoked authentication allows one request
Low 3.5
In plain English
A low-severity security flaw in jetty.project from eclipse. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 60% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Jetty is a Java based web server and servlet engine. Versions 9.4.21 through 9.4.51, 10.0.15, and 11.0.15 are vulnerable to weak authentication. If a Jetty `OpenIdAuthenticator` uses the optional nested `LoginService`, and that `LoginService` decides to revoke an already authenticated user, then the current request will still treat the user as authenticated. The authentication is then cleared from the session and subsequent requests will not be treated as authenticated. So a request on a previously authenticated session could be allowed to bypass authentication after it had been rejected by the `LoginService`. This impacts usages of the jetty-openid which have configured a nested `LoginService` and where that `LoginService` will is capable of rejecting previously authenticated users. Versions 9.4.52, 10.0.16, and 11.0.16 have a patch for this issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | jetty9 | 9.4.50-4+deb12u1 | DSA-5507-1 |
| Debian:12 | jetty9 | 9.4.50-4+deb12u1 | DEBIAN-CVE-2023-41900 |
| Debian:13 | jetty9 | 9.4.52-1 | DEBIAN-CVE-2023-41900 |
| Debian:14 | jetty9 | 9.4.52-1 | DEBIAN-CVE-2023-41900 |
| Maven | org.eclipse.jetty:jetty-openid | 9.4.52.v20230823 | GHSA-pwh8-58vv-vw48 |
| Maven | org.eclipse.jetty:jetty-openid | 10.0.16 | GHSA-pwh8-58vv-vw48 |
| Maven | org.eclipse.jetty:jetty-openid | 11.0.16 | GHSA-pwh8-58vv-vw48 |
| Ubuntu:22.04:LTS | jetty9 | no fix listed | UBUNTU-CVE-2023-41900 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| eclipse | jetty.project | >= 9.4.21, <= 9.4.51>= 10.0.0, <= 10.0.15>= 11.0.0, <= 11.0.15 |
Weakness: CWE-1390 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N
References
- https://github.com/eclipse/jetty.project/security/advisories/GHSA-pwh8-58vv-vw48 x_refsource_CONFIRM
- https://github.com/eclipse/jetty.project/pull/9528 x_refsource_MISC
- https://github.com/eclipse/jetty.project/pull/9660 x_refsource_MISC
- https://www.debian.org/security/2023/dsa-5507
- https://security.netapp.com/advisory/ntap-20231110-0004/