Description
Jetty is a Java based web server and servlet engine. Versions 9.4.21 through 9.4.51, 10.0.15, and 11.0.15 are vulnerable to weak authentication. If a Jetty `OpenIdAuthenticator` uses the optional nested `LoginService`, and that `LoginService` decides to revoke an already authenticated user, then the current request will still treat the user as authenticated. The authentication is then cleared from the session and subsequent requests will not be treated as authenticated. So a request on a previously authenticated session could be allowed to bypass authentication after it had been rejected by the `LoginService`. This impacts usages of the jetty-openid which have configured a nested `LoginService` and where that `LoginService` will is capable of rejecting previously authenticated users. Versions 9.4.52, 10.0.16, and 11.0.16 have a patch for this issue.
Remediation
References
https://github.com/eclipse/jetty.project/pull/9528
https://github.com/eclipse/jetty.project/pull/9660
https://github.com/eclipse/jetty.project/security/advisories/GHSA-pwh8-58vv-vw48
https://security.netapp.com/advisory/ntap-20231110-0004/
https://www.debian.org/security/2023/dsa-5507
Related Vulnerabilities
CVE-2023-37947 Vulnerability in maven package org.openshift.jenkins:openshift-login
CVE-2019-5432 Vulnerability in maven package org.webjars.npm:mqtt-packet
CVE-2019-14893 Vulnerability in maven package com.fasterxml.jackson.core:jackson-databind
CVE-2021-23371 Vulnerability in npm package chrono-node
CVE-2021-41164 Vulnerability in maven package org.webjars.bowergithub.ckeditor:ckeditor4