CVE-2021-34429
published 2021-07-15CVE-2021-34429: For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the content of the WEB-INF…
PriorityP180medium5.3CVSS 3.1
AVNACLPRNUINSUCLINAN
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
99.30%
99.9th percentile
For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and/or bypass some security constraints. This is a variation of the vulnerability reported in CVE-2021-28164/GHSA-v7ff-8wcx-gmc5.
Affected
17 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | jetty9 | < jetty9 9.4.39-3 (bookworm) | jetty9 9.4.39-3 (bookworm) |
| eclipse | jetty | >= 10.0.1 < 10.0.6 | 10.0.6 |
| eclipse | jetty | >= 11.0.1 < 11.0.6 | 11.0.6 |
| eclipse | jetty | >= 9.4.37 < 9.4.43 | 9.4.43 |
| netapp | e-series_santricity_os_controller | 11.0 – 11.70.1 | — |
| oracle | autovue_for_agile_product_lifecycle_management | — | — |
| oracle | communications_cloud_native_core_binding_support_function | — | — |
| oracle | communications_cloud_native_core_security_edge_protection_proxy | — | — |
| oracle | communications_cloud_native_core_service_communication_proxy | — | — |
| oracle | communications_cloud_native_core_unified_data_repository | — | — |
| oracle | communications_diameter_signaling_router | 8.0.0.0 – 8.5.0.2 | — |
| oracle | financial_services_crime_and_compliance_management_studio | — | — |
| oracle | financial_services_crime_and_compliance_management_studio | — | — |
| oracle | rest_data_services | < 22.1.1 | 22.1.1 |
| oracle | retail_eftlink | — | — |
| oracle | stream_analytics | < 19.1.0.0.6.4 | 19.1.0.0.6.4 |
| oracle | stream_analytics | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect exploitation attempts by monitoring HTTP requests containing encoded traversal sequences targeting WEB-INF: look for `%u002e` (Unicode-encoded dot) or `.%00` (null-byte dot) in URI paths, specifically paths resolving to `/WEB-INF/`. ↗
- →The Metasploit auxiliary module `auxiliary/gather/jetty_web_inf_disclosure` can be used to validate exposure; monitor for its characteristic request patterns against `/WEB-INF/` paths. ↗
- ·Affected versions are specifically 9.4.37–9.4.42, 10.0.1–10.0.5, and 11.0.1–11.0.5; detections should be scoped to these Jetty version ranges to reduce false positives. ↗
- ·This is a variation of CVE-2021-28164; environments that patched CVE-2021-28164 may still be vulnerable if not updated to versions beyond the affected ranges listed above. ↗
- ·The nuclei template uses `unsafe: true` mode because the exploit payloads include raw encoded characters (`%u002e`, `.%00`) that standard HTTP clients may normalize before sending, bypassing the vulnerability trigger.
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
ghsa5.3MEDIUM
osv5.3MEDIUM
vulncheck5.3MEDIUM
vendor_debian5.3MEDIUM
vendor_oracle5.3MEDIUM
vendor_redhat5.3MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Administration Console authentication bypass in openfire xmppserver
osv·2023-05-23
CVE-2023-32315 [HIGH] Administration Console authentication bypass in openfire xmppserver
Administration Console authentication bypass in openfire xmppserver
An important security issue affects a range of versions of Openfire, the cross-platform real-time collaboration server based on the XMPP protocol that is created by the Ignite Realtime community.
### Impact
Openfire's administrative console (the Admin Console), a web-based application, was found to be vulnerable to a path traversal attack via the setup environment. This permitted an unauthenticated user to use the unauthenticated Openfire Setup Environment in an already configured Openfire environment to access restricted pages in the Openfire Admin Console reserved for administrative users.
### Cause
Path traversal protections were already in place to protect against exactly this kind of attack, but didn’t defend again
GHSA
Administration Console authentication bypass in openfire xmppserver
ghsa·2023-05-23
CVE-2023-32315 [HIGH] CWE-22 Administration Console authentication bypass in openfire xmppserver
Administration Console authentication bypass in openfire xmppserver
An important security issue affects a range of versions of Openfire, the cross-platform real-time collaboration server based on the XMPP protocol that is created by the Ignite Realtime community.
### Impact
Openfire's administrative console (the Admin Console), a web-based application, was found to be vulnerable to a path traversal attack via the setup environment. This permitted an unauthenticated user to use the unauthenticated Openfire Setup Environment in an already configured Openfire environment to access restricted pages in the Openfire Admin Console reserved for administrative users.
### Cause
Path traversal protections were already in place to protect against exactly this kind of attack, but didn’t defend again
OSV
Encoded URIs can access WEB-INF directory in Eclipse Jetty
osv·2021-07-19·CVSS 5.3
CVE-2021-34429 [MEDIUM] Encoded URIs can access WEB-INF directory in Eclipse Jetty
Encoded URIs can access WEB-INF directory in Eclipse Jetty
### Description
URIs can be crafted using some encoded characters to access the content of the `WEB-INF` directory and/or bypass some security constraints.
This is a variation of the vulnerability reported in [CVE-2021-28164](https://nvd.nist.gov/vuln/detail/CVE-2021-28164)/[GHSA-v7ff-8wcx-gmc5](https://github.com/eclipse/jetty.project/security/advisories/GHSA-v7ff-8wcx-gmc5).
### Impact
The default compliance mode allows requests with URIs that contain a %u002e segment to access protected resources within the WEB-INF directory. For example, a request to `/%u002e/WEB-INF/web.xml` can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application. Similarly, an encoded null chara
GHSA
Encoded URIs can access WEB-INF directory in Eclipse Jetty
ghsa·2021-07-19·CVSS 5.3
CVE-2021-34429 [MEDIUM] CWE-200 Encoded URIs can access WEB-INF directory in Eclipse Jetty
Encoded URIs can access WEB-INF directory in Eclipse Jetty
### Description
URIs can be crafted using some encoded characters to access the content of the `WEB-INF` directory and/or bypass some security constraints.
This is a variation of the vulnerability reported in [CVE-2021-28164](https://nvd.nist.gov/vuln/detail/CVE-2021-28164)/[GHSA-v7ff-8wcx-gmc5](https://github.com/eclipse/jetty.project/security/advisories/GHSA-v7ff-8wcx-gmc5).
### Impact
The default compliance mode allows requests with URIs that contain a %u002e segment to access protected resources within the WEB-INF directory. For example, a request to `/%u002e/WEB-INF/web.xml` can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application. Similarly, an encoded null chara
OSV
CVE-2021-34429: For Eclipse Jetty versions 9
osv·2021-07-15·CVSS 5.3
CVE-2021-34429 [MEDIUM] CVE-2021-34429: For Eclipse Jetty versions 9
For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and/or bypass some security constraints. This is a variation of the vulnerability reported in CVE-2021-28164/GHSA-v7ff-8wcx-gmc5.
VulnCheck
Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5 Security Bypass
vulncheck·2021·CVSS 5.3
CVE-2021-34429 [MEDIUM] Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5 Security Bypass
Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5 Security Bypass
For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and/or bypass some security constraints. This is a variation of the vulnerability reported in CVE-2021-28164/GHSA-v7ff-8wcx-gmc5.
Affected: eclipse jetty
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://web.archive.org/web/20230318134256/https://unit42.paloaltonetworks.com/network-security-trends-aug-oct-2022/
Oracle
Oracle Oracle Fusion Middleware Risk Matrix: Runtime Engine (Apache ZooKeeper) — CVE-2021-34429
vendor_oracle·2023-07-15·CVSS 5.3
CVE-2021-34429 [MEDIUM] Oracle Oracle Fusion Middleware Risk Matrix: Runtime Engine (Apache ZooKeeper) — CVE-2021-34429
Oracle Oracle Fusion Middleware Risk Matrix: Runtime Engine (Apache ZooKeeper) vulnerability
CVE: CVE-2021-34429
CVSS: 5.3
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpujul2023 (JUL 2023)
Oracle
Oracle Oracle Fusion Middleware Risk Matrix: Runtime Java agent for ODI (Eclipse Jetty) — CVE-2021-34429
vendor_oracle·2022-10-15·CVSS 5.3
CVE-2021-34429 [MEDIUM] Oracle Oracle Fusion Middleware Risk Matrix: Runtime Java agent for ODI (Eclipse Jetty) — CVE-2021-34429
Oracle Oracle Fusion Middleware Risk Matrix: Runtime Java agent for ODI (Eclipse Jetty) vulnerability
CVE: CVE-2021-34429
CVSS: 5.3
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpuoct2022 (OCT 2022)
Oracle
Oracle Oracle GoldenGate Risk Matrix: Oracle Stream Analytics (Eclipse Jetty) — CVE-2021-34429
vendor_oracle·2022-07-15·CVSS 5.3
CVE-2021-34429 [MEDIUM] Oracle Oracle GoldenGate Risk Matrix: Oracle Stream Analytics (Eclipse Jetty) — CVE-2021-34429
Oracle Oracle GoldenGate Risk Matrix: Oracle Stream Analytics (Eclipse Jetty) vulnerability
CVE: CVE-2021-34429
CVSS: 5.3
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpujul2022 (JUL 2022)
Oracle
Oracle Oracle Retail Applications Risk Matrix: Framework (Eclipse Jetty) — CVE-2021-34429
vendor_oracle·2022-04-15·CVSS 5.3
CVE-2021-34429 [MEDIUM] Oracle Oracle Retail Applications Risk Matrix: Framework (Eclipse Jetty) — CVE-2021-34429
Oracle Oracle Retail Applications Risk Matrix: Framework (Eclipse Jetty) vulnerability
CVE: CVE-2021-34429
CVSS: 5.3
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpuapr2022 (APR 2022)
Oracle
Oracle Oracle Communications Risk Matrix: Binding Support Function (Eclipse Jetty) — CVE-2021-34429
vendor_oracle·2022-01-15·CVSS 5.3
CVE-2021-34429 [MEDIUM] Oracle Oracle Communications Risk Matrix: Binding Support Function (Eclipse Jetty) — CVE-2021-34429
Oracle Oracle Communications Risk Matrix: Binding Support Function (Eclipse Jetty) vulnerability
CVE: CVE-2021-34429
CVSS: 5.3
Protocol: TCP
Remote exploit: Yes
Affected versions: Network
Advisory: cpujan2022 (JAN 2022)
Red Hat
jetty: crafted URIs allow bypassing security constraints
vendor_redhat·2021-07-15·CVSS 5.3
CVE-2021-34429 [MEDIUM] CWE-200 jetty: crafted URIs allow bypassing security constraints
jetty: crafted URIs allow bypassing security constraints
For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and/or bypass some security constraints. This is a variation of the vulnerability reported in CVE-2021-28164/GHSA-v7ff-8wcx-gmc5.
Statement: OCP 3.11 is out of the support scope for Moderate and Low impact vulnerabilities because is already in the Maintenance Support phase, hence the affected OCP 3.11 component has been marked as "ooss".
Red Hat OpenStack Platform's OpenDaylight will not be updated for this flaw because it was deprecated as of OpenStack Platform 14 and is only receiving security fixes for Critical flaws.
Package: jetty (Red Hat Enterprise Linux 7)
Debian
CVE-2021-34429: jetty9 - For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs ca...
vendor_debian·2021·CVSS 5.3
CVE-2021-34429 [MEDIUM] CVE-2021-34429: jetty9 - For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs ca...
For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and/or bypass some security constraints. This is a variation of the vulnerability reported in CVE-2021-28164/GHSA-v7ff-8wcx-gmc5.
Scope: local
bookworm: resolved (fixed in 9.4.39-3)
bullseye: resolved (fixed in 9.4.39-3)
forky: resolved (fixed in 9.4.39-3)
sid: resolved (fixed in 9.4.39-3)
trixie: resolved (fixed in 9.4.39-3)
Suricata
ET WEB_SPECIFIC_APPS Jetty WEB-INF Information Leak Attempt Inbound (CVE-2021-34429)
suricata·2021-07-27·CVSS 5.3
CVE-2021-34429 [MEDIUM] ET WEB_SPECIFIC_APPS Jetty WEB-INF Information Leak Attempt Inbound (CVE-2021-34429)
ET WEB_SPECIFIC_APPS Jetty WEB-INF Information Leak Attempt Inbound (CVE-2021-34429)
Rule: alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET WEB_SPECIFIC_APPS Jetty WEB-INF Information Leak Attempt Inbound (CVE-2021-34429)"; flow:established,to_server; flowbits:set,ET.2021.34429.attempt; http.method; content:"GET"; http.uri; content:"/WEB-INF/web.xml"; fast_pattern; http.uri.raw; content:"/%u002e/"; startswith; reference:cve,2021-34429; classtype:attempted-admin; sid:2033460; rev:2; metadata:created_at 2021_07_27, cve CVE_2021_34429, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_03_14;)
Suricata
ET WEB_SPECIFIC_APPS Jetty WEB-INF Information Leak Successful Exploitation (CVE-2021-34429)
suricata·2021-07-27·CVSS 5.3
CVE-2021-34429 [MEDIUM] ET WEB_SPECIFIC_APPS Jetty WEB-INF Information Leak Successful Exploitation (CVE-2021-34429)
ET WEB_SPECIFIC_APPS Jetty WEB-INF Information Leak Successful Exploitation (CVE-2021-34429)
Rule: alert http [$HOME_NET,$HTTP_SERVERS] any -> any any (msg:"ET WEB_SPECIFIC_APPS Jetty WEB-INF Information Leak Successful Exploitation (CVE-2021-34429)"; flow:established,to_client; flowbits:isset,ET.2021.34429.attempt; http.stat_code; content:"200"; file.data; content:""; fast_pattern; reference:cve,2021-34429; classtype:attempted-admin; sid:2033461; rev:3; metadata:created_at 2021_07_27, cve CVE_2021_34429, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_03_14;)
Exploit-DB
Eclipse Jetty 11.0.5 - Sensitive File Disclosure
exploitdb·2021-11-03·CVSS 5.3
CVE-2021-34429 [MEDIUM] Eclipse Jetty 11.0.5 - Sensitive File Disclosure
Eclipse Jetty 11.0.5 - Sensitive File Disclosure
---
# Exploit Title: Eclipse Jetty 11.0.5 - Sensitive File Disclosure
# Date: 2021-11-03
# Exploit Author: Mayank Deshmukh
# Vendor Homepage: https://www.eclipse.org/jetty/
# Software Link: https://repo1.maven.org/maven2/org/eclipse/jetty/jetty-distribution/
# Version: 9.4.37 ≤ version
ColdFusionX - Web Application
Metasploit
Jetty WEB-INF File Disclosure
metasploit
Jetty WEB-INF File Disclosure
Jetty WEB-INF File Disclosure
Jetty suffers from a vulnerability where certain encoded URIs and ambiguous paths can access protected files in the WEB-INF folder. Versions effected are: 9.4.37.v20210219, 9.4.38.v20210224 and 9.4.37-9.4.42, 10.0.1-10.0.5, 11.0.1-11.0.5. Exploitation can obtain any file in the WEB-INF folder, but web.xml is most likely to have information of value.
Nuclei
Eclipse Jetty - Information Disclosure
nuclei·CVSS 5.3
CVE-2021-34429 [MEDIUM] Eclipse Jetty - Information Disclosure
Eclipse Jetty - Information Disclosure
Eclipse Jetty 9.4.37-9.4.42, 10.0.1-10.0.5 and 11.0.1-11.0.5 are susceptible to improper authorization. URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and/or bypass some security constraints. An attacker can potentially obtain sensitive information, modify data, and/or execute unauthorized administrative operations. This is a variation of the vulnerability reported in CVE-2021-28164/GHSA-v7ff-8wcx-gmc5.
Template:
id: CVE-2021-34429
info:
name: Eclipse Jetty - Information Disclosure
author: bernardofsr,am0nt31r0
severity: medium
description: |
Eclipse Jetty 9.4.37-9.4.42, 10.0.1-10.0.5 and 11.0.1-11.0.5 are susceptible to improper authorization. URIs can be crafted using some encoded characters to a
Bugzilla
CVE-2021-34429 jetty: crafted URIs allow bypassing security constraints
bugzilla·2021-07-23·CVSS 5.3
CVE-2021-34429 [MEDIUM] CVE-2021-34429 jetty: crafted URIs allow bypassing security constraints
CVE-2021-34429 jetty: crafted URIs allow bypassing security constraints
For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and/or bypass some security constraints.
Upstream Issue:
https://github.com/eclipse/jetty.project/security/advisories/GHSA-vjv5-gp2w-65vm
Discussion:
Created jetty tracking bugs for this issue:
Affects: fedora-all [bug 1985225]
---
This vulnerability is out of security support scope for the following products:
* Red Hat JBoss A-MQ 6
Please refer to https://access.redhat.com/support/policy/updates/jboss_notes for more details.
---
This vulnerability is out of security support scope for the following products:
* Red Hat JBoss A-MQ 6
* Red Ha
HackerOne
web.xml configuration file disclosure
hackerone·2021-04-16·CVSS 5.3
CVE-2021-34429 [MEDIUM] web.xml configuration file disclosure
web.xml configuration file disclosure
Information disclosed via https://www.glassdoor.com/web.xml which has been resolved.
Thanks, @stregh for your report and find. Looking forward to more reports from you.
[CVE-2021-34429](http://www.securityspace.com/smysecure/catid.html?id=1.3.6.1.4.1.25623.1.0.117480)
CVSS Score:
5.0
CVSS Vector:
AV:N/AC:L/Au:N/C:P/I:N/A:N
https://github.com/eclipse/jetty.project/security/advisories/GHSA-vjv5-gp2w-65vmhttps://lists.apache.org/thread.html/r029c0c6833c8bb6acb094733fd7b75029d633f47a92f1c9d14391fc0%40%3Cnotifications.zookeeper.apache.org%3Ehttps://lists.apache.org/thread.html/r02f940c27e997a277ff14e79e84551382e1081e8978b417e0c2b0857%40%3Ccommits.kafka.apache.org%3Ehttps://lists.apache.org/thread.html/r0626f279ebf65506110a897e3a57ccd4072803ee5434b2503e070398%40%3Ccommits.zookeeper.apache.org%3Ehttps://lists.apache.org/thread.html/r2a3ea27cca2ac7352d392b023b72e824387bc9ff16ba245ec663bdc6%40%3Cissues.zookeeper.apache.org%3Ehttps://lists.apache.org/thread.html/r2e32390cb7aedb39069e5b18aa130ca53e766258518faee63c31d3ea%40%3Cnotifications.zookeeper.apache.org%3Ehttps://lists.apache.org/thread.html/r3aefe613abce594c71ace50088d2529bbde65d08b8e7ff2c2723aaa1%40%3Cdev.santuario.apache.org%3Ehttps://lists.apache.org/thread.html/r3c55b0baa4dc38958ae147b2f216e212605f1071297f845e14477d36%40%3Cissues.zookeeper.apache.org%3Ehttps://lists.apache.org/thread.html/r44ea39ca8110de7353bfec88f58aa3aa58a42bb324b8772512ee190c%40%3Ccommits.zookeeper.apache.org%3Ehttps://lists.apache.org/thread.html/r46900f74dbb7d168aeac43bf0e7f64825376bb7eb74d31a5b33344ce%40%3Cjira.kafka.apache.org%3Ehttps://lists.apache.org/thread.html/r46f748c1dc9cf9b6c1c18f6b5bfc3a869907f68f72e17666f2f30f24%40%3Cnotifications.zookeeper.apache.org%3Ehttps://lists.apache.org/thread.html/r4727d282b5c2d951057845a46065d59f6e33132edc0a14f41c26b01e%40%3Cdev.kafka.apache.org%3Ehttps://lists.apache.org/thread.html/r48a93f2bc025acd7c7e341ed3864bfdeb75f0c768d41bc247e1a1f63%40%3Cnotifications.zookeeper.apache.org%3Ehttps://lists.apache.org/thread.html/r5678d994d4dd8e7c838eed3bbc1a83a7f6bc62724b0cce67e8892a45%40%3Cnotifications.zookeeper.apache.org%3Ehttps://lists.apache.org/thread.html/r679d96f981d4c92724090ed2d5e8565a1d655a72bb315550489f052e%40%3Cjira.kafka.apache.org%3Ehttps://lists.apache.org/thread.html/r6e6f50c1ce1fb592cb43e913f5be23df104d50751465f8f1952ace0c%40%3Cjira.kafka.apache.org%3Ehttps://lists.apache.org/thread.html/r721ab6a5fa8d45bec76714b674f5d4caed2ebfeca69ad1d6d4caae6c%40%3Cdev.hbase.apache.org%3Ehttps://lists.apache.org/thread.html/r74fdc446df551fe89a0a16957a1bfdaad19380e0c1afd30625685a9c%40%3Cjira.kafka.apache.org%3Ehttps://lists.apache.org/thread.html/r756443e9d50af7e8c3df82e2c45105f452c8e8195ddbc0c00f58d5fe%40%3Ccommits.kafka.apache.org%3Ehttps://lists.apache.org/thread.html/r763840320a80e515331cbc1e613fa93f25faf62e991974171a325c82%40%3Cdev.zookeeper.apache.org%3Ehttps://lists.apache.org/thread.html/r7dd079fa0ac6f47ba1ad0af98d7d0276547b8a4e005f034fb1016951%40%3Cissues.zookeeper.apache.org%3Ehttps://lists.apache.org/thread.html/r833a4c8bdbbfeb8a2cd38238e7b59f83edd5c1a0e508b587fc551a46%40%3Cissues.hbase.apache.org%3Ehttps://lists.apache.org/thread.html/r8e6c116628c1277c3cf132012a66c46a0863fa2a3037c0707d4640d4%40%3Cissues.zookeeper.apache.org%3Ehttps://lists.apache.org/thread.html/r90e7b4c42a96d74c219e448bee6a329ab0cd3205c44b63471d96c3ab%40%3Cissues.zookeeper.apache.org%3Ehttps://lists.apache.org/thread.html/r9d245c6c884bbc804a472116d730c1a01676bf24f93206a34923fc64%40%3Ccommits.kafka.apache.org%3Ehttps://lists.apache.org/thread.html/r9e6158d72ef25077c2dc59fbddade2eacf7d259a2556c97a989f2fe8%40%3Ccommits.pulsar.apache.org%3Ehttps://lists.apache.org/thread.html/rb33d65c3e5686f2e3b9bb8a032a44163b2f2ad9d31a8727338f213c1%40%3Ccommits.pulsar.apache.org%3Ehttps://lists.apache.org/thread.html/rc26807be68748b3347decdcd03ae183622244b0b4cb09223d4b7e500%40%3Ccommits.pulsar.apache.org%3Ehttps://lists.apache.org/thread.html/rcb157f55b9ae41b3076801de927c6fca1669c6d8eaf11a9df5dbeb46%40%3Cnotifications.zookeeper.apache.org%3Ehttps://lists.apache.org/thread.html/rcea249eb7a0d243f21696e4985de33f3780399bf7b31ea1f6d489b8b%40%3Cissues.zookeeper.apache.org%3Ehttps://lists.apache.org/thread.html/re01890eef49d4201018f2c97e26536e3e75f441ecdbcf91986c3bc17%40%3Cjira.kafka.apache.org%3Ehttps://lists.apache.org/thread.html/re3de01414ccf682fe0951205f806dd8e94440798fd64c55a4941de3e%40%3Cjira.kafka.apache.org%3Ehttps://lists.apache.org/thread.html/re5e9bb535db779506013ef8799dc2a299e77cdad6668aa94c456dba6%40%3Cjira.kafka.apache.org%3Ehttps://lists.apache.org/thread.html/re850203ef8700cb826534dd4a1cb9f5b07bb8f6f973b39ff7838d3ba%40%3Cissues.hbase.apache.org%3Ehttps://security.netapp.com/advisory/ntap-20210819-0006/https://www.oracle.com/security-alerts/cpuapr2022.htmlhttps://www.oracle.com/security-alerts/cpujan2022.htmlhttps://www.oracle.com/security-alerts/cpujul2022.htmlhttps://github.com/eclipse/jetty.project/security/advisories/GHSA-vjv5-gp2w-65vmhttps://lists.apache.org/thread.html/r029c0c6833c8bb6acb094733fd7b75029d633f47a92f1c9d14391fc0%40%3Cnotifications.zookeeper.apache.org%3Ehttps://lists.apache.org/thread.html/r02f940c27e997a277ff14e79e84551382e1081e8978b417e0c2b0857%40%3Ccommits.kafka.apache.org%3Ehttps://lists.apache.org/thread.html/r0626f279ebf65506110a897e3a57ccd4072803ee5434b2503e070398%40%3Ccommits.zookeeper.apache.org%3Ehttps://lists.apache.org/thread.html/r2a3ea27cca2ac7352d392b023b72e824387bc9ff16ba245ec663bdc6%40%3Cissues.zookeeper.apache.org%3Ehttps://lists.apache.org/thread.html/r2e32390cb7aedb39069e5b18aa130ca53e766258518faee63c31d3ea%40%3Cnotifications.zookeeper.apache.org%3Ehttps://lists.apache.org/thread.html/r3aefe613abce594c71ace50088d2529bbde65d08b8e7ff2c2723aaa1%40%3Cdev.santuario.apache.org%3Ehttps://lists.apache.org/thread.html/r3c55b0baa4dc38958ae147b2f216e212605f1071297f845e14477d36%40%3Cissues.zookeeper.apache.org%3Ehttps://lists.apache.org/thread.html/r44ea39ca8110de7353bfec88f58aa3aa58a42bb324b8772512ee190c%40%3Ccommits.zookeeper.apache.org%3Ehttps://lists.apache.org/thread.html/r46900f74dbb7d168aeac43bf0e7f64825376bb7eb74d31a5b33344ce%40%3Cjira.kafka.apache.org%3Ehttps://lists.apache.org/thread.html/r46f748c1dc9cf9b6c1c18f6b5bfc3a869907f68f72e17666f2f30f24%40%3Cnotifications.zookeeper.apache.org%3Ehttps://lists.apache.org/thread.html/r4727d282b5c2d951057845a46065d59f6e33132edc0a14f41c26b01e%40%3Cdev.kafka.apache.org%3Ehttps://lists.apache.org/thread.html/r48a93f2bc025acd7c7e341ed3864bfdeb75f0c768d41bc247e1a1f63%40%3Cnotifications.zookeeper.apache.org%3Ehttps://lists.apache.org/thread.html/r5678d994d4dd8e7c838eed3bbc1a83a7f6bc62724b0cce67e8892a45%40%3Cnotifications.zookeeper.apache.org%3Ehttps://lists.apache.org/thread.html/r679d96f981d4c92724090ed2d5e8565a1d655a72bb315550489f052e%40%3Cjira.kafka.apache.org%3Ehttps://lists.apache.org/thread.html/r6e6f50c1ce1fb592cb43e913f5be23df104d50751465f8f1952ace0c%40%3Cjira.kafka.apache.org%3Ehttps://lists.apache.org/thread.html/r721ab6a5fa8d45bec76714b674f5d4caed2ebfeca69ad1d6d4caae6c%40%3Cdev.hbase.apache.org%3Ehttps://lists.apache.org/thread.html/r74fdc446df551fe89a0a16957a1bfdaad19380e0c1afd30625685a9c%40%3Cjira.kafka.apache.org%3Ehttps://lists.apache.org/thread.html/r756443e9d50af7e8c3df82e2c45105f452c8e8195ddbc0c00f58d5fe%40%3Ccommits.kafka.apache.org%3Ehttps://lists.apache.org/thread.html/r763840320a80e515331cbc1e613fa93f25faf62e991974171a325c82%40%3Cdev.zookeeper.apache.org%3Ehttps://lists.apache.org/thread.html/r7dd079fa0ac6f47ba1ad0af98d7d0276547b8a4e005f034fb1016951%40%3Cissues.zookeeper.apache.org%3Ehttps://lists.apache.org/thread.html/r833a4c8bdbbfeb8a2cd38238e7b59f83edd5c1a0e508b587fc551a46%40%3Cissues.hbase.apache.org%3Ehttps://lists.apache.org/thread.html/r8e6c116628c1277c3cf132012a66c46a0863fa2a3037c0707d4640d4%40%3Cissues.zookeeper.apache.org%3Ehttps://lists.apache.org/thread.html/r90e7b4c42a96d74c219e448bee6a329ab0cd3205c44b63471d96c3ab%40%3Cissues.zookeeper.apache.org%3Ehttps://lists.apache.org/thread.html/r9d245c6c884bbc804a472116d730c1a01676bf24f93206a34923fc64%40%3Ccommits.kafka.apache.org%3Ehttps://lists.apache.org/thread.html/r9e6158d72ef25077c2dc59fbddade2eacf7d259a2556c97a989f2fe8%40%3Ccommits.pulsar.apache.org%3Ehttps://lists.apache.org/thread.html/rb33d65c3e5686f2e3b9bb8a032a44163b2f2ad9d31a8727338f213c1%40%3Ccommits.pulsar.apache.org%3Ehttps://lists.apache.org/thread.html/rc26807be68748b3347decdcd03ae183622244b0b4cb09223d4b7e500%40%3Ccommits.pulsar.apache.org%3Ehttps://lists.apache.org/thread.html/rcb157f55b9ae41b3076801de927c6fca1669c6d8eaf11a9df5dbeb46%40%3Cnotifications.zookeeper.apache.org%3Ehttps://lists.apache.org/thread.html/rcea249eb7a0d243f21696e4985de33f3780399bf7b31ea1f6d489b8b%40%3Cissues.zookeeper.apache.org%3Ehttps://lists.apache.org/thread.html/re01890eef49d4201018f2c97e26536e3e75f441ecdbcf91986c3bc17%40%3Cjira.kafka.apache.org%3Ehttps://lists.apache.org/thread.html/re3de01414ccf682fe0951205f806dd8e94440798fd64c55a4941de3e%40%3Cjira.kafka.apache.org%3Ehttps://lists.apache.org/thread.html/re5e9bb535db779506013ef8799dc2a299e77cdad6668aa94c456dba6%40%3Cjira.kafka.apache.org%3Ehttps://lists.apache.org/thread.html/re850203ef8700cb826534dd4a1cb9f5b07bb8f6f973b39ff7838d3ba%40%3Cissues.hbase.apache.org%3Ehttps://security.netapp.com/advisory/ntap-20210819-0006/https://www.oracle.com/security-alerts/cpuapr2022.htmlhttps://www.oracle.com/security-alerts/cpujan2022.htmlhttps://www.oracle.com/security-alerts/cpujul2022.html
2021-07-15
Published
Exploited in the wild