CVE-2021-28164
published 2021-04-01CVE-2021-28164: In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access…
PriorityP265medium5.3CVSS 3.1
AVNACLPRNUINSUCLINAN
EXPLOIT
EPSS
82.37%
99.6th percentile
In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF directory. For example a request to /context/%2e/WEB-INF/web.xml can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.
Affected
33 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | jetty9 | < jetty9 9.4.39-3 (bookworm) | jetty9 9.4.39-3 (bookworm) |
| debian | jetty9 | < jetty9 9.4.39-1 (bookworm) | jetty9 9.4.39-1 (bookworm) |
| eclipse | jetty | — | — |
| eclipse | jetty | — | — |
| eclipse | jetty | >= 10.0.1 < 10.0.6 | 10.0.6 |
| eclipse | jetty | >= 11.0.1 < 11.0.6 | 11.0.6 |
| eclipse | jetty | >= 9.4.37 < 9.4.43 | 9.4.43 |
| netapp | e-series_santricity_os_controller | 11.0 – 11.70.1 | — |
| netapp | storage_replication_adapter_for_clustered_data_ontap | >= 9.6 | — |
| netapp | vasa_provider_for_clustered_data_ontap | >= 9.6 | — |
| netapp | virtual_storage_console | >= 9.6 | — |
| oracle | autovue_for_agile_product_lifecycle_management | — | — |
| oracle | banking_apis | — | — |
| oracle | banking_apis | — | — |
| oracle | banking_digital_experience | — | — |
| oracle | banking_digital_experience | — | — |
| oracle | communications_cloud_native_core_binding_support_function | — | — |
| oracle | communications_cloud_native_core_security_edge_protection_proxy | — | — |
| oracle | communications_cloud_native_core_service_communication_proxy | — | — |
| oracle | communications_cloud_native_core_unified_data_repository | — | — |
| oracle | communications_diameter_signaling_router | 8.0.0.0 – 8.5.0.2 | — |
| oracle | communications_session_route_manager | 8.0.0 – 8.2.4 | — |
| oracle | financial_services_crime_and_compliance_management_studio | — | — |
| oracle | financial_services_crime_and_compliance_management_studio | — | — |
| oracle | rest_data_services | < 22.1.1 | 22.1.1 |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect HTTP GET requests where the URI contains the encoded segment %2e or %2e%2e followed by /WEB-INF/ — this is the canonical exploit path for CVE-2021-28164. ↗
- →A successful exploit response will contain both the XML web-app schema string 'java.sun.com' in the body and 'application/xml' in the Content-Type header with HTTP 200 — use these as confirmation matchers. ↗
- →Baseline check: a direct request to /WEB-INF/web.xml should return non-200/non-404 (blocked); if the %2e-encoded variant returns 200 with XML content, the instance is vulnerable. ↗
- →Shodan query 'cpe:"cpe:2.3:a:eclipse:jetty"' can be used to identify internet-exposed Jetty instances for targeted scanning. ↗
- ·The vulnerability is only present when Jetty is running in its DEFAULT compliance mode. Explicitly configuring a stricter URI compliance mode mitigates the issue. ↗
- ·Affected versions are strictly 9.4.37.v20210219 and 9.4.38.v20210224; versions outside this range are not affected by CVE-2021-28164 (a related but distinct issue, CVE-2021-34429, covers 9.4.37–9.4.42, 10.0.1–10.0.5, 11.0.1–11.0.5). ↗
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
ghsa5.3MEDIUM
osv5.3MEDIUM
vulncheck5.3MEDIUM
vendor_debian5.3MEDIUM
vendor_oracle5.3MEDIUM
vendor_redhat5.3MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Encoded URIs can access WEB-INF directory in Eclipse Jetty
osv·2021-07-19·CVSS 5.3
CVE-2021-34429 [MEDIUM] Encoded URIs can access WEB-INF directory in Eclipse Jetty
Encoded URIs can access WEB-INF directory in Eclipse Jetty
### Description
URIs can be crafted using some encoded characters to access the content of the `WEB-INF` directory and/or bypass some security constraints.
This is a variation of the vulnerability reported in [CVE-2021-28164](https://nvd.nist.gov/vuln/detail/CVE-2021-28164)/[GHSA-v7ff-8wcx-gmc5](https://github.com/eclipse/jetty.project/security/advisories/GHSA-v7ff-8wcx-gmc5).
### Impact
The default compliance mode allows requests with URIs that contain a %u002e segment to access protected resources within the WEB-INF directory. For example, a request to `/%u002e/WEB-INF/web.xml` can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application. Similarly, an encoded null chara
GHSA
Encoded URIs can access WEB-INF directory in Eclipse Jetty
ghsa·2021-07-19·CVSS 5.3
CVE-2021-34429 [MEDIUM] CWE-200 Encoded URIs can access WEB-INF directory in Eclipse Jetty
Encoded URIs can access WEB-INF directory in Eclipse Jetty
### Description
URIs can be crafted using some encoded characters to access the content of the `WEB-INF` directory and/or bypass some security constraints.
This is a variation of the vulnerability reported in [CVE-2021-28164](https://nvd.nist.gov/vuln/detail/CVE-2021-28164)/[GHSA-v7ff-8wcx-gmc5](https://github.com/eclipse/jetty.project/security/advisories/GHSA-v7ff-8wcx-gmc5).
### Impact
The default compliance mode allows requests with URIs that contain a %u002e segment to access protected resources within the WEB-INF directory. For example, a request to `/%u002e/WEB-INF/web.xml` can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application. Similarly, an encoded null chara
OSV
CVE-2021-34429: For Eclipse Jetty versions 9
osv·2021-07-15·CVSS 5.3
CVE-2021-34429 [MEDIUM] CVE-2021-34429: For Eclipse Jetty versions 9
For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and/or bypass some security constraints. This is a variation of the vulnerability reported in CVE-2021-28164/GHSA-v7ff-8wcx-gmc5.
OSV
Authorization Before Parsing and Canonicalization in jetty
osv·2021-04-06
CVE-2021-28164 [MEDIUM] Authorization Before Parsing and Canonicalization in jetty
Authorization Before Parsing and Canonicalization in jetty
Release 9.4.37 introduced a more precise implementation of [RFC3986](https://tools.ietf.org/html/rfc3986#section-3.3) with regards to URI decoding, together with some new compliance modes to optionally allow support of some URI that may have ambiguous interpretation within the Servlet specified API methods behaviours. The default mode allowed % encoded . characters to be excluded for URI normalisation, which is correct by the RFC, but is not assumed by common Servlet implementations. The default compliance mode allows requests with URIs that contain `%2e` or `%2e%2e` segments to access protected resources within the `WEB-INF` directory. For example a request to `/context/%2e/WEB-INF/web.xml` can retrieve the `web.xml` file. This c
GHSA
Authorization Before Parsing and Canonicalization in jetty
ghsa·2021-04-06
CVE-2021-28164 [MEDIUM] CWE-200 Authorization Before Parsing and Canonicalization in jetty
Authorization Before Parsing and Canonicalization in jetty
Release 9.4.37 introduced a more precise implementation of [RFC3986](https://tools.ietf.org/html/rfc3986#section-3.3) with regards to URI decoding, together with some new compliance modes to optionally allow support of some URI that may have ambiguous interpretation within the Servlet specified API methods behaviours. The default mode allowed % encoded . characters to be excluded for URI normalisation, which is correct by the RFC, but is not assumed by common Servlet implementations. The default compliance mode allows requests with URIs that contain `%2e` or `%2e%2e` segments to access protected resources within the `WEB-INF` directory. For example a request to `/context/%2e/WEB-INF/web.xml` can retrieve the `web.xml` file. This c
OSV
CVE-2021-28164: In Eclipse Jetty 9
osv·2021-04-01·CVSS 5.3
CVE-2021-28164 [MEDIUM] CVE-2021-28164: In Eclipse Jetty 9
In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF directory. For example a request to /context/%2e/WEB-INF/web.xml can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.
VulnCheck
Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5 Security Bypass
vulncheck·2021·CVSS 5.3
CVE-2021-34429 [MEDIUM] Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5 Security Bypass
Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5 Security Bypass
For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and/or bypass some security constraints. This is a variation of the vulnerability reported in CVE-2021-28164/GHSA-v7ff-8wcx-gmc5.
Affected: eclipse jetty
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://web.archive.org/web/20230318134256/https://unit42.paloaltonetworks.com/network-security-trends-aug-oct-2022/
Oracle
Oracle Oracle Financial Services Applications Risk Matrix: Framework (Apache Ignite) — CVE-2021-28164
vendor_oracle·2022-01-15·CVSS 5.3
CVE-2021-28164 [MEDIUM] Oracle Oracle Financial Services Applications Risk Matrix: Framework (Apache Ignite) — CVE-2021-28164
Oracle Oracle Financial Services Applications Risk Matrix: Framework (Apache Ignite) vulnerability
CVE: CVE-2021-28164
CVSS: 5.3
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpujan2022 (JAN 2022)
Red Hat
jetty: crafted URIs allow bypassing security constraints
vendor_redhat·2021-07-15·CVSS 5.3
CVE-2021-34429 [MEDIUM] CWE-200 jetty: crafted URIs allow bypassing security constraints
jetty: crafted URIs allow bypassing security constraints
For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and/or bypass some security constraints. This is a variation of the vulnerability reported in CVE-2021-28164/GHSA-v7ff-8wcx-gmc5.
Statement: OCP 3.11 is out of the support scope for Moderate and Low impact vulnerabilities because is already in the Maintenance Support phase, hence the affected OCP 3.11 component has been marked as "ooss".
Red Hat OpenStack Platform's OpenDaylight will not be updated for this flaw because it was deprecated as of OpenStack Platform 14 and is only receiving security fixes for Critical flaws.
Package: jetty (Red Hat Enterprise Linux 7)
Red Hat
jetty: Ambiguous paths can access WEB-INF
vendor_redhat·2021-04-01·CVSS 5.3
CVE-2021-28164 [MEDIUM] CWE-200 jetty: Ambiguous paths can access WEB-INF
jetty: Ambiguous paths can access WEB-INF
In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF directory. For example a request to /context/%2e/WEB-INF/web.xml can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.
In Jetty the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF directory. An attacker can use this vulnerability to reveal sensitive information regarding the implementation of a web application.
Statement: Red Hat OpenStack Platform's OpenDaylight will not be updated for this flaw because
Debian
CVE-2021-34429: jetty9 - For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs ca...
vendor_debian·2021·CVSS 5.3
CVE-2021-34429 [MEDIUM] CVE-2021-34429: jetty9 - For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs ca...
For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and/or bypass some security constraints. This is a variation of the vulnerability reported in CVE-2021-28164/GHSA-v7ff-8wcx-gmc5.
Scope: local
bookworm: resolved (fixed in 9.4.39-3)
bullseye: resolved (fixed in 9.4.39-3)
forky: resolved (fixed in 9.4.39-3)
sid: resolved (fixed in 9.4.39-3)
trixie: resolved (fixed in 9.4.39-3)
Debian
CVE-2021-28164: jetty9 - In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mo...
vendor_debian·2021·CVSS 5.3
CVE-2021-28164 [MEDIUM] CVE-2021-28164: jetty9 - In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mo...
In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF directory. For example a request to /context/%2e/WEB-INF/web.xml can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.
Scope: local
bookworm: resolved (fixed in 9.4.39-1)
bullseye: resolved (fixed in 9.4.39-1)
forky: resolved (fixed in 9.4.39-1)
sid: resolved (fixed in 9.4.39-1)
trixie: resolved (fixed in 9.4.39-1)
No detection rules found.
Exploit-DB
Jetty 9.4.37.v20210219 - Information Disclosure
exploitdb·2021-10-22·CVSS 5.3
CVE-2021-28164 [MEDIUM] Jetty 9.4.37.v20210219 - Information Disclosure
Jetty 9.4.37.v20210219 - Information Disclosure
---
# Exploit Title: Jetty 9.4.37.v20210219 - Information Disclosure
# Date: 2021-10-21
# Exploit Author: Mayank Deshmukh
# Vendor Homepage: https://www.eclipse.org/jetty/
# Software Link: https://repo1.maven.org/maven2/org/eclipse/jetty/jetty-distribution/9.4.37.v20210219/
# Version: 9.4.37.v20210219 and 9.4.38.v20210224
# Tested on: Kali Linux
# CVE : CVE-2021-28164
POC #1 - web.xml
GET /%2e/WEB-INF/web.xml HTTP/1.1
Host: localhost:8080
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0
Metasploit
Jetty WEB-INF File Disclosure
metasploit
Jetty WEB-INF File Disclosure
Jetty WEB-INF File Disclosure
Jetty suffers from a vulnerability where certain encoded URIs and ambiguous paths can access protected files in the WEB-INF folder. Versions effected are: 9.4.37.v20210219, 9.4.38.v20210224 and 9.4.37-9.4.42, 10.0.1-10.0.5, 11.0.1-11.0.5. Exploitation can obtain any file in the WEB-INF folder, but web.xml is most likely to have information of value.
Nuclei
Eclipse Jetty - Information Disclosure
nuclei·CVSS 5.3
CVE-2021-34429 [MEDIUM] Eclipse Jetty - Information Disclosure
Eclipse Jetty - Information Disclosure
Eclipse Jetty 9.4.37-9.4.42, 10.0.1-10.0.5 and 11.0.1-11.0.5 are susceptible to improper authorization. URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and/or bypass some security constraints. An attacker can potentially obtain sensitive information, modify data, and/or execute unauthorized administrative operations. This is a variation of the vulnerability reported in CVE-2021-28164/GHSA-v7ff-8wcx-gmc5.
Template:
id: CVE-2021-34429
info:
name: Eclipse Jetty - Information Disclosure
author: bernardofsr,am0nt31r0
severity: medium
description: |
Eclipse Jetty 9.4.37-9.4.42, 10.0.1-10.0.5 and 11.0.1-11.0.5 are susceptible to improper authorization. URIs can be crafted using some encoded characters to a
Nuclei
Eclipse Jetty - Information Disclosure
nuclei·CVSS 5.3
CVE-2021-28164 [MEDIUM] Eclipse Jetty - Information Disclosure
Eclipse Jetty - Information Disclosure
Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224 is susceptible to improper authorization. The default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF directory. An attacker can access sensitive information regarding the implementation of a web application.
Template:
id: CVE-2021-28164
info:
name: Eclipse Jetty - Information Disclosure
author: noamrathaus
severity: medium
description: |
Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224 is susceptible to improper authorization. The default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF directory. An attacker can access sensitive informatio
http://packetstormsecurity.com/files/164590/Jetty-9.4.37.v20210219-Information-Disclosure.htmlhttps://github.com/eclipse/jetty.project/security/advisories/GHSA-v7ff-8wcx-gmc5https://lists.apache.org/thread.html/r0841b06b48324cfc81325de3c05a92e53f997185f9d71ff47734d961%40%3Cissues.solr.apache.org%3Ehttps://lists.apache.org/thread.html/r111f1ce28b133a8090ca4f809a1bdf18a777426fc058dc3a16c39c66%40%3Cissues.solr.apache.org%3Ehttps://lists.apache.org/thread.html/r2a3ea27cca2ac7352d392b023b72e824387bc9ff16ba245ec663bdc6%40%3Cissues.zookeeper.apache.org%3Ehttps://lists.apache.org/thread.html/r2ea2f0541121f17e470a0184843720046c59d4bde6d42bf5ca6fad81%40%3Cissues.solr.apache.org%3Ehttps://lists.apache.org/thread.html/r3c55b0baa4dc38958ae147b2f216e212605f1071297f845e14477d36%40%3Cissues.zookeeper.apache.org%3Ehttps://lists.apache.org/thread.html/r4a66bfbf62281e31bc1345ebecbfd96f35199eecd77bfe4e903e906f%40%3Cissues.ignite.apache.org%3Ehttps://lists.apache.org/thread.html/r4b1fef117bccc7f5fd4c45fd2cabc26838df823fe5ca94bc42a4fd46%40%3Cissues.ignite.apache.org%3Ehttps://lists.apache.org/thread.html/r5b3693da7ecb8a75c0e930b4ca26a5f97aa0207d9dae4aa8cc65fe6b%40%3Cissues.ignite.apache.org%3Ehttps://lists.apache.org/thread.html/r6ac9e263129328c0db9940d72b4a6062e703c58918dd34bd22cdf8dd%40%3Cissues.ignite.apache.org%3Ehttps://lists.apache.org/thread.html/r763840320a80e515331cbc1e613fa93f25faf62e991974171a325c82%40%3Cdev.zookeeper.apache.org%3Ehttps://lists.apache.org/thread.html/r780c3c210a05c5bf7b4671303f46afc3fe56758e92864e1a5f0590d0%40%3Cjira.kafka.apache.org%3Ehttps://lists.apache.org/thread.html/r7dd079fa0ac6f47ba1ad0af98d7d0276547b8a4e005f034fb1016951%40%3Cissues.zookeeper.apache.org%3Ehttps://lists.apache.org/thread.html/r8e6c116628c1277c3cf132012a66c46a0863fa2a3037c0707d4640d4%40%3Cissues.zookeeper.apache.org%3Ehttps://lists.apache.org/thread.html/r90e7b4c42a96d74c219e448bee6a329ab0cd3205c44b63471d96c3ab%40%3Cissues.zookeeper.apache.org%3Ehttps://lists.apache.org/thread.html/r9974f64723875052e02787b2a5eda689ac5247c71b827d455e5dc9a6%40%3Cissues.solr.apache.org%3Ehttps://lists.apache.org/thread.html/rbc075a4ac85e7a8e47420b7383f16ffa0af3b792b8423584735f369f%40%3Cissues.solr.apache.org%3Ehttps://lists.apache.org/thread.html/rcea249eb7a0d243f21696e4985de33f3780399bf7b31ea1f6d489b8b%40%3Cissues.zookeeper.apache.org%3Ehttps://lists.apache.org/thread.html/rd0471252aeb3384c3cfa6d131374646d4641b80dd313e7b476c47a9c%40%3Cissues.solr.apache.org%3Ehttps://lists.apache.org/thread.html/rd7c8fb305a8637480dc943ba08424c8992dccad018cd1405eb2afe0e%40%3Cdev.ignite.apache.org%3Ehttps://security.netapp.com/advisory/ntap-20210611-0006/https://www.oracle.com/security-alerts/cpuapr2022.htmlhttps://www.oracle.com/security-alerts/cpujan2022.htmlhttps://www.oracle.com/security-alerts/cpuoct2021.htmlhttp://packetstormsecurity.com/files/164590/Jetty-9.4.37.v20210219-Information-Disclosure.htmlhttps://github.com/eclipse/jetty.project/security/advisories/GHSA-v7ff-8wcx-gmc5https://lists.apache.org/thread.html/r0841b06b48324cfc81325de3c05a92e53f997185f9d71ff47734d961%40%3Cissues.solr.apache.org%3Ehttps://lists.apache.org/thread.html/r111f1ce28b133a8090ca4f809a1bdf18a777426fc058dc3a16c39c66%40%3Cissues.solr.apache.org%3Ehttps://lists.apache.org/thread.html/r2a3ea27cca2ac7352d392b023b72e824387bc9ff16ba245ec663bdc6%40%3Cissues.zookeeper.apache.org%3Ehttps://lists.apache.org/thread.html/r2ea2f0541121f17e470a0184843720046c59d4bde6d42bf5ca6fad81%40%3Cissues.solr.apache.org%3Ehttps://lists.apache.org/thread.html/r3c55b0baa4dc38958ae147b2f216e212605f1071297f845e14477d36%40%3Cissues.zookeeper.apache.org%3Ehttps://lists.apache.org/thread.html/r4a66bfbf62281e31bc1345ebecbfd96f35199eecd77bfe4e903e906f%40%3Cissues.ignite.apache.org%3Ehttps://lists.apache.org/thread.html/r4b1fef117bccc7f5fd4c45fd2cabc26838df823fe5ca94bc42a4fd46%40%3Cissues.ignite.apache.org%3Ehttps://lists.apache.org/thread.html/r5b3693da7ecb8a75c0e930b4ca26a5f97aa0207d9dae4aa8cc65fe6b%40%3Cissues.ignite.apache.org%3Ehttps://lists.apache.org/thread.html/r6ac9e263129328c0db9940d72b4a6062e703c58918dd34bd22cdf8dd%40%3Cissues.ignite.apache.org%3Ehttps://lists.apache.org/thread.html/r763840320a80e515331cbc1e613fa93f25faf62e991974171a325c82%40%3Cdev.zookeeper.apache.org%3Ehttps://lists.apache.org/thread.html/r780c3c210a05c5bf7b4671303f46afc3fe56758e92864e1a5f0590d0%40%3Cjira.kafka.apache.org%3Ehttps://lists.apache.org/thread.html/r7dd079fa0ac6f47ba1ad0af98d7d0276547b8a4e005f034fb1016951%40%3Cissues.zookeeper.apache.org%3Ehttps://lists.apache.org/thread.html/r8e6c116628c1277c3cf132012a66c46a0863fa2a3037c0707d4640d4%40%3Cissues.zookeeper.apache.org%3Ehttps://lists.apache.org/thread.html/r90e7b4c42a96d74c219e448bee6a329ab0cd3205c44b63471d96c3ab%40%3Cissues.zookeeper.apache.org%3Ehttps://lists.apache.org/thread.html/r9974f64723875052e02787b2a5eda689ac5247c71b827d455e5dc9a6%40%3Cissues.solr.apache.org%3Ehttps://lists.apache.org/thread.html/rbc075a4ac85e7a8e47420b7383f16ffa0af3b792b8423584735f369f%40%3Cissues.solr.apache.org%3Ehttps://lists.apache.org/thread.html/rcea249eb7a0d243f21696e4985de33f3780399bf7b31ea1f6d489b8b%40%3Cissues.zookeeper.apache.org%3Ehttps://lists.apache.org/thread.html/rd0471252aeb3384c3cfa6d131374646d4641b80dd313e7b476c47a9c%40%3Cissues.solr.apache.org%3Ehttps://lists.apache.org/thread.html/rd7c8fb305a8637480dc943ba08424c8992dccad018cd1405eb2afe0e%40%3Cdev.ignite.apache.org%3Ehttps://security.netapp.com/advisory/ntap-20210611-0006/https://www.oracle.com/security-alerts/cpuapr2022.htmlhttps://www.oracle.com/security-alerts/cpujan2022.htmlhttps://www.oracle.com/security-alerts/cpuoct2021.html
2021-04-01
Published