Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

org.eclipse.jetty:jetty-openid

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Low, CVSS 3.5MavenPublished

    Jetty's OpenId Revoked authentication allows one request

    CVE-2023-41900 · GHSA-pwh8-58vv-vw48

    Affected
    • Maven org.eclipse.jetty:jetty-openid >= 9.4.21, <= 9.4.51; >= 10.0.0, <= 10.0.15; >= 11.0.0, <= 11.0.15
    Fixed in
    10.0.169.4.52.v2023082311.0.16· Vendor fix available
    Issue
    If a Jetty OpenIdAuthenticator uses the optional nested LoginService, and that LoginService decides to revoke an already authenticated user, then the current request will still treat the user as authenticated. The authentication is then cleared from the session and subsequent requests will not be treated as authenticated. So a request on a previously authenticated session could be allowed to bypass authentication after it had been rejected by the LoginService. Impact This impacts usages of the jetty-openid which have configured a nested LoginService and where that LoginService will is capable of rejecting previously authenticated users. Original Report working on a custom OpenIdAuthenticator, I discovered the following: https://github.com/eclipse/jetty.project/blob/jetty-10.0.14/jetty-openid/src/main/java/org/eclipse/jetty/security/openid/OpenIdAuthenticator.java#L505 In the case where the LoginService does return that the authentication has been revoked (from the validate() call on…

    Recommended action: Upgrade to 11.0.16, 10.0.16 or 9.4.52.v20230823 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →