NetSight
IP …
low3.5

CVE-2021-34428

SessionListener can prevent a session from being invalidated breaking logout

Impact

### Impact If an exception is thrown from the `SessionListener#sessionDestroyed()` method, then the session ID is not invalidated in the session ID manager. On deployments with clustered sessions and multiple contexts this can result in a session not being invalidated. This can result in an application used on a shared computer being left logged in. There is no known path for an attacker to induce such an exception to be thrown, thus they must rely on an application to throw such an exception. The OP has also identified that during the call to `sessionDestroyed`, the `getLastAccessedTime()` throws an `IllegalStateException`, which potentially contrary to the servlet spec, so applications calling this method may always throw and fail to log out. If such an application was only tested on a non clustered test environment, then it may be deployed on a clustered environment with multiple contexts and fail to log out. ### Workarounds The application should catch all Throwables within their `SessionListener#sessionDestroyed()` implementations.

Affected packages

EcosystemPackageAffectedFixed in
mavenorg.eclipse.jetty:jetty-server<= 9.4.409.4.41

Affected products

VendorProductAffected versions
EclipseJetty
through 9.4.40
from 10.0.0 through 10.0.2
from 11.0.0 through 11.0.2
DebianDebian Linux
Version 10.0
NetappActive Iq Unified Manager
All versions
NetappE-Series Santricity Os Controller
from 11.0 through 11.70.1
NetappE-Series Santricity Web Services
All versions
NetappElement Plug-In For Vcenter Server
All versions
NetappSantricity Cloud Connector
All versions
NetappSnap Creator Framework
All versions
NetappSnapmanager
All versions
OracleAutovue For Agile Product Lifecycle Management
Version 21.0.2
OracleCommunications Element Manager
Version 8.2.2
OracleCommunications Services Gatekeeper
Version 7.0

Weakness classification

CWE-613

References