{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "IBM QRadar SIEM versions 7.3.x ant\u00e9rieures \u00e0 7.3.3 Fix Pack 12",
      "product": {
        "name": "QRadar SIEM",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "IBM QRadar SIEM versions 7.5.x ant\u00e9rieures \u00e0 7.5.0 Update Pack 2",
      "product": {
        "name": "QRadar SIEM",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "IBM Spectrum Discover versions ant\u00e9rieures \u00e0 2.0.4.7",
      "product": {
        "name": "Spectrum",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "IBM QRadar SIEM versions 7.4.x ant\u00e9rieures \u00e0 7.4.3 Fix Pack 6",
      "product": {
        "name": "QRadar SIEM",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2021-44906",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-44906"
    },
    {
      "name": "CVE-2021-20180",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-20180"
    },
    {
      "name": "CVE-2021-45960",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-45960"
    },
    {
      "name": "CVE-2022-24407",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-24407"
    },
    {
      "name": "CVE-2020-25658",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-25658"
    },
    {
      "name": "CVE-2020-15084",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-15084"
    },
    {
      "name": "CVE-2021-28169",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-28169"
    },
    {
      "name": "CVE-2021-3677",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-3677"
    },
    {
      "name": "CVE-2022-22823",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-22823"
    },
    {
      "name": "CVE-2022-24773",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-24773"
    },
    {
      "name": "CVE-2022-25315",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-25315"
    },
    {
      "name": "CVE-2022-22822",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-22822"
    },
    {
      "name": "CVE-2020-7720",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-7720"
    },
    {
      "name": "CVE-2022-24302",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-24302"
    },
    {
      "name": "CVE-2020-14330",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-14330"
    },
    {
      "name": "CVE-2021-42581",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-42581"
    },
    {
      "name": "CVE-2021-43138",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-43138"
    },
    {
      "name": "CVE-2021-28163",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-28163"
    },
    {
      "name": "CVE-2021-28165",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-28165"
    },
    {
      "name": "CVE-2022-23852",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-23852"
    },
    {
      "name": "CVE-2022-22825",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-22825"
    },
    {
      "name": "CVE-2021-4083",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-4083"
    },
    {
      "name": "CVE-2021-43859",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-43859"
    },
    {
      "name": "CVE-2022-25235",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-25235"
    },
    {
      "name": "CVE-2021-41496",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-41496"
    },
    {
      "name": "CVE-2021-46143",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-46143"
    },
    {
      "name": "CVE-2021-46462",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-46462"
    },
    {
      "name": "CVE-2021-22060",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-22060"
    },
    {
      "name": "CVE-2021-23386",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-23386"
    },
    {
      "name": "CVE-2022-0718",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-0718"
    },
    {
      "name": "CVE-2019-18874",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-18874"
    },
    {
      "name": "CVE-2022-22827",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-22827"
    },
    {
      "name": "CVE-2022-1214",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-1214"
    },
    {
      "name": "CVE-2022-24772",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-24772"
    },
    {
      "name": "CVE-2022-25236",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-25236"
    },
    {
      "name": "CVE-2022-22720",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-22720"
    },
    {
      "name": "CVE-2021-34429",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-34429"
    },
    {
      "name": "CVE-2022-0122",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-0122"
    },
    {
      "name": "CVE-2021-28164",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-28164"
    },
    {
      "name": "CVE-2022-22826",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-22826"
    },
    {
      "name": "CVE-2022-24771",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-24771"
    },
    {
      "name": "CVE-2021-44907",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-44907"
    },
    {
      "name": "CVE-2017-1000048",
      "url": "https://www.cve.org/CVERecord?id=CVE-2017-1000048"
    },
    {
      "name": "CVE-2021-46461",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-46461"
    },
    {
      "name": "CVE-2022-22824",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-22824"
    },
    {
      "name": "CVE-2021-34141",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-34141"
    },
    {
      "name": "CVE-2020-13757",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-13757"
    },
    {
      "name": "CVE-2020-7598",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-7598"
    },
    {
      "name": "CVE-2021-3533",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-3533"
    },
    {
      "name": "CVE-2021-46463",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-46463"
    },
    {
      "name": "CVE-2017-16137",
      "url": "https://www.cve.org/CVERecord?id=CVE-2017-16137"
    },
    {
      "name": "CVE-2022-26488",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-26488"
    },
    {
      "name": "CVE-2021-34428",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-34428"
    },
    {
      "name": "CVE-2020-28463",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-28463"
    }
  ],
  "links": [],
  "reference": "CERTFR-2022-AVI-767",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2022-08-24T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits IBM.\nCertaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une\nex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0 distance\net un contournement de la politique de s\u00e9curit\u00e9.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits IBM",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 6614909 du 23 ao\u00fbt 2022",
      "url": "https://www.ibm.com/support/pages/node/6614909"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 6614725 du 23 ao\u00fbt 2022",
      "url": "https://www.ibm.com/support/pages/node/6614725"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "IBM Cognos Command Center version 10.2.4.1 sans le correctif de s\u00e9curit\u00e9 IF17",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2020-27223",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-27223"
    },
    {
      "name": "CVE-2020-27218",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-27218"
    },
    {
      "name": "CVE-2021-29425",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-29425"
    },
    {
      "name": "CVE-2021-28169",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-28169"
    },
    {
      "name": "CVE-2022-4304",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-4304"
    },
    {
      "name": "CVE-2022-420004",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-420004"
    },
    {
      "name": "CVE-2022-31160",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-31160"
    },
    {
      "name": "CVE-2019-11358",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-11358"
    },
    {
      "name": "CVE-2022-21624",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-21624"
    },
    {
      "name": "CVE-2022-2048",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-2048"
    },
    {
      "name": "CVE-2021-28165",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-28165"
    },
    {
      "name": "CVE-2021-37533",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-37533"
    },
    {
      "name": "CVE-2017-7658",
      "url": "https://www.cve.org/CVERecord?id=CVE-2017-7658"
    },
    {
      "name": "CVE-2022-2047",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-2047"
    },
    {
      "name": "CVE-2022-42889",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-42889"
    },
    {
      "name": "CVE-2018-12545",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-12545"
    },
    {
      "name": "CVE-2022-21449",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-21449"
    },
    {
      "name": "CVE-2022-21434",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-21434"
    },
    {
      "name": "CVE-2017-7657",
      "url": "https://www.cve.org/CVERecord?id=CVE-2017-7657"
    },
    {
      "name": "CVE-2018-12536",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-12536"
    },
    {
      "name": "CVE-2022-42004",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-42004"
    },
    {
      "name": "CVE-2022-2191",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-2191"
    },
    {
      "name": "CVE-2020-11022",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-11022"
    },
    {
      "name": "CVE-2022-38707",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-38707"
    },
    {
      "name": "CVE-2019-10241",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-10241"
    },
    {
      "name": "CVE-2019-10247",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-10247"
    },
    {
      "name": "CVE-2017-7656",
      "url": "https://www.cve.org/CVERecord?id=CVE-2017-7656"
    },
    {
      "name": "CVE-2022-42003",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-42003"
    },
    {
      "name": "CVE-2022-21443",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-21443"
    },
    {
      "name": "CVE-2015-9251",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-9251"
    },
    {
      "name": "CVE-2021-34428",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-34428"
    },
    {
      "name": "CVE-2020-11023",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-11023"
    }
  ],
  "links": [],
  "reference": "CERTFR-2023-AVI-0357",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2023-05-05T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans IBM Cognos.\nCertaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer un\nprobl\u00e8me de s\u00e9curit\u00e9 non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur, une ex\u00e9cution de code\narbitraire \u00e0 distance et un d\u00e9ni de service \u00e0 distance.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans IBM Cognos",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 6988263 du 04 mai 2023",
      "url": "https://www.ibm.com/support/pages/node/6988263"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 6983274 du 04 mai 2023",
      "url": "https://www.ibm.com/support/pages/node/6983274"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Sterling Connect:Express pour UNIX versions 1.5.x ant\u00e9rieures \u00e0 1.5.0.17010",
      "product": {
        "name": "Sterling",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "QRadar Assistant versions ant\u00e9rieures \u00e0 3.8.1",
      "product": {
        "name": "QRadar",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "Cognos Analytics Mobile (Android) versions 1.1.x ant\u00e9rieures \u00e0 1.1.20",
      "product": {
        "name": "Cognos Analytics",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "Sterling External Authentication Server versions 6.0.x ant\u00e9rieures \u00e0 6.0.3.1 GA",
      "product": {
        "name": "Sterling",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "SOAR QRadar Plugin App versions ant\u00e9rieures \u00e0 5.5.0",
      "product": {
        "name": "QRadar",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "Cognos Analytics versions 12.0.x ant\u00e9rieures \u00e0 12.0.4 ",
      "product": {
        "name": "Cognos Analytics",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "Sterling Secure Proxy versions 6.1.x ant\u00e9rieures \u00e0 6.1.0.1 GA",
      "product": {
        "name": "Sterling",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "Cognos Analytics versions 11.2.x ant\u00e9rieures \u00e0 11.2.4 FP4",
      "product": {
        "name": "Cognos Analytics",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "Sterling External Authentication Server versions 6.1.0.x ant\u00e9rieures \u00e0 6.1.0.2 GA",
      "product": {
        "name": "Sterling",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "Cognos Analytics Mobile (iOS) versions 1.1.x ant\u00e9rieures \u00e0 1.1.20",
      "product": {
        "name": "Cognos Analytics",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "Sterling Secure Proxy versions 6.0.x ant\u00e9rieures \u00e0 6.0.3.1 GA",
      "product": {
        "name": "Sterling",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2022-0144",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-0144"
    },
    {
      "name": "CVE-2021-44906",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-44906"
    },
    {
      "name": "CVE-2024-37891",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-37891"
    },
    {
      "name": "CVE-2023-38264",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-38264"
    },
    {
      "name": "CVE-2024-22201",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-22201"
    },
    {
      "name": "CVE-2022-46175",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-46175"
    },
    {
      "name": "CVE-2024-21144",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-21144"
    },
    {
      "name": "CVE-2023-25166",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-25166"
    },
    {
      "name": "CVE-2024-4068",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-4068"
    },
    {
      "name": "CVE-2023-46234",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-46234"
    },
    {
      "name": "CVE-2023-28856",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-28856"
    },
    {
      "name": "CVE-2021-28169",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-28169"
    },
    {
      "name": "CVE-2018-12538",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-12538"
    },
    {
      "name": "CVE-2024-35176",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-35176"
    },
    {
      "name": "CVE-2024-21890",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-21890"
    },
    {
      "name": "CVE-2024-21896",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-21896"
    },
    {
      "name": "CVE-2023-50312",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-50312"
    },
    {
      "name": "CVE-2024-3933",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-3933"
    },
    {
      "name": "CVE-2022-25883",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-25883"
    },
    {
      "name": "CVE-2024-22025",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-22025"
    },
    {
      "name": "CVE-2023-38737",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-38737"
    },
    {
      "name": "CVE-2024-29415",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-29415"
    },
    {
      "name": "CVE-2022-36943",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-36943"
    },
    {
      "name": "CVE-2024-43398",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-43398"
    },
    {
      "name": "CVE-2023-44487",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-44487"
    },
    {
      "name": "CVE-2023-38009",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-38009"
    },
    {
      "name": "CVE-2023-45133",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-45133"
    },
    {
      "name": "CVE-2023-26049",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-26049"
    },
    {
      "name": "CVE-2023-46809",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-46809"
    },
    {
      "name": "CVE-2020-27216",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-27216"
    },
    {
      "name": "CVE-2019-13224",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-13224"
    },
    {
      "name": "CVE-2022-29622",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-29622"
    },
    {
      "name": "CVE-2021-40690",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-40690"
    },
    {
      "name": "CVE-2024-4067",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-4067"
    },
    {
      "name": "CVE-2024-30172",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-30172"
    },
    {
      "name": "CVE-2021-43138",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-43138"
    },
    {
      "name": "CVE-2023-45145",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-45145"
    },
    {
      "name": "CVE-2024-22019",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-22019"
    },
    {
      "name": "CVE-2023-0842",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-0842"
    },
    {
      "name": "CVE-2023-22467",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-22467"
    },
    {
      "name": "CVE-2024-21011",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-21011"
    },
    {
      "name": "CVE-2024-22329",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-22329"
    },
    {
      "name": "CVE-2024-45296",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-45296"
    },
    {
      "name": "CVE-2024-21892",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-21892"
    },
    {
      "name": "CVE-2024-21147",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-21147"
    },
    {
      "name": "CVE-2022-43383",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-43383"
    },
    {
      "name": "CVE-2019-16163",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-16163"
    },
    {
      "name": "CVE-2024-39908",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-39908"
    },
    {
      "name": "CVE-2022-3517",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-3517"
    },
    {
      "name": "CVE-2024-35195",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-35195"
    },
    {
      "name": "CVE-2024-41946",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41946"
    },
    {
      "name": "CVE-2024-21140",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-21140"
    },
    {
      "name": "CVE-2024-21094",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-21094"
    },
    {
      "name": "CVE-2023-51775",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-51775"
    },
    {
      "name": "CVE-2018-12545",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-12545"
    },
    {
      "name": "CVE-2024-5569",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-5569"
    },
    {
      "name": "CVE-2023-52428",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-52428"
    },
    {
      "name": "CVE-2024-41784",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41784"
    },
    {
      "name": "CVE-2021-3803",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-3803"
    },
    {
      "name": "CVE-2023-40167",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-40167"
    },
    {
      "name": "CVE-2023-41900",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-41900"
    },
    {
      "name": "CVE-2024-21138",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-21138"
    },
    {
      "name": "CVE-2022-24834",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-24834"
    },
    {
      "name": "CVE-2023-36479",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-36479"
    },
    {
      "name": "CVE-2024-6119",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-6119"
    },
    {
      "name": "CVE-2024-37890",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-37890"
    },
    {
      "name": "CVE-2023-44483",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-44483"
    },
    {
      "name": "CVE-2024-27270",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-27270"
    },
    {
      "name": "CVE-2024-21145",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-21145"
    },
    {
      "name": "CVE-2024-21891",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-21891"
    },
    {
      "name": "CVE-2022-38900",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-38900"
    },
    {
      "name": "CVE-2024-22017",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-22017"
    },
    {
      "name": "CVE-2022-0235",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-0235"
    },
    {
      "name": "CVE-2019-10241",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-10241"
    },
    {
      "name": "CVE-2022-24736",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-24736"
    },
    {
      "name": "CVE-2024-25042",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-25042"
    },
    {
      "name": "CVE-2024-34064",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-34064"
    },
    {
      "name": "CVE-2020-15168",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-15168"
    },
    {
      "name": "CVE-2023-29262",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-29262"
    },
    {
      "name": "CVE-2023-26048",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-26048"
    },
    {
      "name": "CVE-2024-21085",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-21085"
    },
    {
      "name": "CVE-2023-42282",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-42282"
    },
    {
      "name": "CVE-2022-24735",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-24735"
    },
    {
      "name": "CVE-2024-21131",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-21131"
    },
    {
      "name": "CVE-2024-39689",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-39689"
    },
    {
      "name": "CVE-2024-41123",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41123"
    },
    {
      "name": "CVE-2019-19012",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-19012"
    },
    {
      "name": "CVE-2024-27267",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-27267"
    },
    {
      "name": "CVE-2012-2677",
      "url": "https://www.cve.org/CVERecord?id=CVE-2012-2677"
    },
    {
      "name": "CVE-2024-6345",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-6345"
    },
    {
      "name": "CVE-2021-34428",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-34428"
    }
  ],
  "links": [],
  "reference": "CERTFR-2024-AVI-0923",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2024-10-25T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    },
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits IBM. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une \u00e9l\u00e9vation de privil\u00e8ges et un d\u00e9ni de service \u00e0 distance.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits IBM",
  "vendor_advisories": [
    {
      "published_at": "2024-10-21",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7173631",
      "url": "https://www.ibm.com/support/pages/node/7173631"
    },
    {
      "published_at": "2024-10-24",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7174016",
      "url": "https://www.ibm.com/support/pages/node/7174016"
    },
    {
      "published_at": "2024-10-24",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7174015",
      "url": "https://www.ibm.com/support/pages/node/7174015"
    },
    {
      "published_at": "2024-10-21",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7173632",
      "url": "https://www.ibm.com/support/pages/node/7173632"
    },
    {
      "published_at": "2024-10-21",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7172691",
      "url": "https://www.ibm.com/support/pages/node/7172691"
    },
    {
      "published_at": "2024-10-21",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7172692",
      "url": "https://www.ibm.com/support/pages/node/7172692"
    },
    {
      "published_at": "2024-10-21",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7173592",
      "url": "https://www.ibm.com/support/pages/node/7173592"
    },
    {
      "published_at": "2024-10-23",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7173866",
      "url": "https://www.ibm.com/support/pages/node/7173866"
    }
  ]
}

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "A1002EA3-6026-4AB3-B198-39AD7DBF3D10",
              "versionEndExcluding": "9.4.41",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "AC1A749D-761A-44B2-B7E3-6B24D34252A7",
              "versionEndExcluding": "10.0.3",
              "versionStartIncluding": "10.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "0692BAE8-6F03-4ADE-88F4-AD2038D64380",
              "versionEndExcluding": "11.0.3",
              "versionStartIncluding": "11.0.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "DEECE5FC-CACF-4496-A3E7-164736409252",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.14.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "4479F76A-4B67-41CC-98C7-C76B81050F8E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:rest_data_services:*:*:*:*:-:*:*:*",
              "matchCriteriaId": "2C134E13-D6B8-4F28-9EF0-C12BF8A380CF",
              "versionEndExcluding": "21.3",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:*",
              "matchCriteriaId": "F3E0B672-3E06-4422-B2A4-0BD073AEC2A1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*",
              "matchCriteriaId": "B55E8D50-99B4-47EC-86F9-699B67D473CE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:hci:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "8A6E548F-62E9-40CB-85DA-FDAA0F0096C6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:management_services_for_element_software:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "86B51137-28D9-41F2-AFA2-3CC22B4954D1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:snap_creator_framework:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "9F4754FB-E3EB-454A-AB1A-AE3835C5350C",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "For Eclipse Jetty versions \u003c= 9.4.40, \u003c= 10.0.2, \u003c= 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory. For example a request to `/concat?/%2557EB-INF/web.xml` can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application."
    },
    {
      "lang": "es",
      "value": "Para Eclipse Jetty versiones anteriores a 9.4.40 incluy\u00e9ndola, versiones anteriores a 10.0.2 incluy\u00e9ndola, versiones anteriores a 11.0.2 incluy\u00e9ndola, es posible que las petici\u00f3nes al ConcatServlet con una ruta doblemente codificada acceder a recursos protegidos dentro del directorio WEB-INF.\u0026#xa0;Por ejemplo, una petici\u00f3n a \"/concat?/%2557EB-INF/web.xml\" puede recuperar el archivo web.xml.\u0026#xa0;Esto puede revelar informaci\u00f3n confidencial sobre la implementaci\u00f3n de una aplicaci\u00f3n web"
    }
  ],
  "id": "CVE-2021-28169",
  "lastModified": "2024-11-21T05:59:14.710",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 5.0,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4,
        "source": "emo@eclipse.org",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2021-06-09T02:15:06.853",
  "references": [
    {
      "source": "emo@eclipse.org",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://github.com/eclipse/jetty.project/security/advisories/GHSA-gwcr-j4wh-j3cq"
    },
    {
      "source": "emo@eclipse.org",
      "url": "https://lists.apache.org/thread.html/r04a4b4553a23aff26f42635a6ae388c3b162aab30a88d12e59d05168%40%3Cjira.kafka.apache.org%3E"
    },
    {
      "source": "emo@eclipse.org",
      "url": "https://lists.apache.org/thread.html/r234f6452297065636356f43654cdacef565b8f9ceb0e0c07ffb8c73b%40%3Cdev.kafka.apache.org%3E"
    },
    {
      "source": "emo@eclipse.org",
      "url": "https://lists.apache.org/thread.html/r2721aba31a8562639c4b937150897e24f78f747cdbda8641c0f659fe%40%3Cusers.kafka.apache.org%3E"
    },
    {
      "source": "emo@eclipse.org",
      "url": "https://lists.apache.org/thread.html/r284de9c5399486dfff12ab9e7323ca720dd7019a9a3e11c8510a7140%40%3Cjira.kafka.apache.org%3E"
    },
    {
      "source": "emo@eclipse.org",
      "url": "https://lists.apache.org/thread.html/r29678972c3f8164b151fd7a5802785d402e530c09870a82ffc7681a4%40%3Cdev.kafka.apache.org%3E"
    },
    {
      "source": "emo@eclipse.org",
      "url": "https://lists.apache.org/thread.html/r32b0b640ad2be3b858f0af51c68a7d5c5a66a462c8bbb93699825cd3%40%3Cissues.zookeeper.apache.org%3E"
    },
    {
      "source": "emo@eclipse.org",
      "url": "https://lists.apache.org/thread.html/r33eb06b05afbc7df28d31055cae0cb3fd36cab808c884bf6d680bea5%40%3Cdev.zookeeper.apache.org%3E"
    },
    {
      "source": "emo@eclipse.org",
      "url": "https://lists.apache.org/thread.html/r67c4f90658fde875521c949448c54c98517beecdc7f618f902c620ec%40%3Cissues.zookeeper.apache.org%3E"
    },
    {
      "source": "emo@eclipse.org",
      "url": "https://lists.apache.org/thread.html/r8a1a332899a1f92c8118b0895b144b27a78e3f25b9d58a34dd5eb084%40%3Cnotifications.zookeeper.apache.org%3E"
    },
    {
      "source": "emo@eclipse.org",
      "url": "https://lists.apache.org/thread.html/r91e34ff61aff8fd25a3f2a21539597c6ef7589a31c199b0a9546477c%40%3Cjira.kafka.apache.org%3E"
    },
    {
      "source": "emo@eclipse.org",
      "url": "https://lists.apache.org/thread.html/rb1292d30462b9baedea7c5d9594fc75990d9aa0ec223b48054ca9c25%40%3Cjira.kafka.apache.org%3E"
    },
    {
      "source": "emo@eclipse.org",
      "url": "https://lists.apache.org/thread.html/rbefa055282d52d6b58d29a79fbb0be65ab0a38d25f00bd29eaf5e6fd%40%3Cnotifications.zookeeper.apache.org%3E"
    },
    {
      "source": "emo@eclipse.org",
      "url": "https://lists.apache.org/thread.html/rd5b52362f5edf98e0dcab6541a381f571cccc05ad9188e793af688f3%40%3Cjira.kafka.apache.org%3E"
    },
    {
      "source": "emo@eclipse.org",
      "url": "https://lists.apache.org/thread.html/rddbb4f8d5db23265bb63d14ef4b3723b438abc1589f877db11d35450%40%3Cissues.zookeeper.apache.org%3E"
    },
    {
      "source": "emo@eclipse.org",
      "url": "https://lists.apache.org/thread.html/ref1c161a1621504e673f9197b49e6efe5a33ce3f0e6d8f1f804fc695%40%3Cjira.kafka.apache.org%3E"
    },
    {
      "source": "emo@eclipse.org",
      "url": "https://lists.apache.org/thread.html/rf36f1114e84a3379b20587063686148e2d5a39abc0b8a66ff2a9087a%40%3Cissues.zookeeper.apache.org%3E"
    },
    {
      "source": "emo@eclipse.org",
      "url": "https://lists.apache.org/thread.html/rfff6ff8ffb31e8a32619c79774def44b6ffbb037c128c5ad3eab7171%40%3Cissues.zookeeper.apache.org%3E"
    },
    {
      "source": "emo@eclipse.org",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "https://lists.debian.org/debian-lts-announce/2021/06/msg00017.html"
    },
    {
      "source": "emo@eclipse.org",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.netapp.com/advisory/ntap-20210727-0009/"
    },
    {
      "source": "emo@eclipse.org",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.debian.org/security/2021/dsa-4949"
    },
    {
      "source": "emo@eclipse.org",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
    },
    {
      "source": "emo@eclipse.org",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
    },
    {
      "source": "emo@eclipse.org",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://github.com/eclipse/jetty.project/security/advisories/GHSA-gwcr-j4wh-j3cq"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.apache.org/thread.html/r04a4b4553a23aff26f42635a6ae388c3b162aab30a88d12e59d05168%40%3Cjira.kafka.apache.org%3E"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.apache.org/thread.html/r234f6452297065636356f43654cdacef565b8f9ceb0e0c07ffb8c73b%40%3Cdev.kafka.apache.org%3E"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.apache.org/thread.html/r2721aba31a8562639c4b937150897e24f78f747cdbda8641c0f659fe%40%3Cusers.kafka.apache.org%3E"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.apache.org/thread.html/r284de9c5399486dfff12ab9e7323ca720dd7019a9a3e11c8510a7140%40%3Cjira.kafka.apache.org%3E"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.apache.org/thread.html/r29678972c3f8164b151fd7a5802785d402e530c09870a82ffc7681a4%40%3Cdev.kafka.apache.org%3E"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.apache.org/thread.html/r32b0b640ad2be3b858f0af51c68a7d5c5a66a462c8bbb93699825cd3%40%3Cissues.zookeeper.apache.org%3E"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.apache.org/thread.html/r33eb06b05afbc7df28d31055cae0cb3fd36cab808c884bf6d680bea5%40%3Cdev.zookeeper.apache.org%3E"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.apache.org/thread.html/r67c4f90658fde875521c949448c54c98517beecdc7f618f902c620ec%40%3Cissues.zookeeper.apache.org%3E"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.apache.org/thread.html/r8a1a332899a1f92c8118b0895b144b27a78e3f25b9d58a34dd5eb084%40%3Cnotifications.zookeeper.apache.org%3E"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.apache.org/thread.html/r91e34ff61aff8fd25a3f2a21539597c6ef7589a31c199b0a9546477c%40%3Cjira.kafka.apache.org%3E"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.apache.org/thread.html/rb1292d30462b9baedea7c5d9594fc75990d9aa0ec223b48054ca9c25%40%3Cjira.kafka.apache.org%3E"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.apache.org/thread.html/rbefa055282d52d6b58d29a79fbb0be65ab0a38d25f00bd29eaf5e6fd%40%3Cnotifications.zookeeper.apache.org%3E"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.apache.org/thread.html/rd5b52362f5edf98e0dcab6541a381f571cccc05ad9188e793af688f3%40%3Cjira.kafka.apache.org%3E"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.apache.org/thread.html/rddbb4f8d5db23265bb63d14ef4b3723b438abc1589f877db11d35450%40%3Cissues.zookeeper.apache.org%3E"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.apache.org/thread.html/ref1c161a1621504e673f9197b49e6efe5a33ce3f0e6d8f1f804fc695%40%3Cjira.kafka.apache.org%3E"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.apache.org/thread.html/rf36f1114e84a3379b20587063686148e2d5a39abc0b8a66ff2a9087a%40%3Cissues.zookeeper.apache.org%3E"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.apache.org/thread.html/rfff6ff8ffb31e8a32619c79774def44b6ffbb037c128c5ad3eab7171%40%3Cissues.zookeeper.apache.org%3E"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "https://lists.debian.org/debian-lts-announce/2021/06/msg00017.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.netapp.com/advisory/ntap-20210727-0009/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.debian.org/security/2021/dsa-4949"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
    }
  ],
  "sourceIdentifier": "emo@eclipse.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ],
      "source": "emo@eclipse.org",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 9.4.40"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.eclipse.jetty:jetty-servlets"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "9.4.41"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 10.0.2"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.eclipse.jetty:jetty-servlets"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 11.0.2"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.eclipse.jetty:jetty-servlets"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0"
            },
            {
              "fixed": "11.0.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2021-28169"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-06-09T20:02:50Z",
    "nvd_published_at": "2021-06-09T02:15:00Z",
    "severity": "MODERATE"
  },
  "details": "Requests to the `ConcatServlet` and `WelcomeFilter` are able to access protected resources within the `WEB-INF` directory. For example a request to the `ConcatServlet` with a URI of `/concat?/%2557EB-INF/web.xml` can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.\n\nThis occurs because both `ConcatServlet` and `WelcomeFilter` decode the supplied path to verify it is not within the `WEB-INF` or `META-INF` directories. It then uses this decoded path to call `RequestDispatcher` which will also do decoding of the path. This double decoding allows paths with a doubly encoded `WEB-INF` to bypass this security check.\n\n### Impact\nThis affects all versions of `ConcatServlet` and `WelcomeFilter` in versions before 9.4.41, 10.0.3 and 11.0.3.\n\n### Workarounds\n\nIf you cannot update to the latest version of Jetty, you can instead deploy your own version of the [`ConcatServlet`](https://github.com/eclipse/jetty.project/blob/4204526d2fdad355e233f6bf18a44bfe028ee00b/jetty-servlets/src/main/java/org/eclipse/jetty/servlets/ConcatServlet.java) and/or the [`WelcomeFilter`](https://github.com/eclipse/jetty.project/blob/4204526d2fdad355e233f6bf18a44bfe028ee00b/jetty-servlets/src/main/java/org/eclipse/jetty/servlets/WelcomeFilter.java) by using the code from the latest version of Jetty.\n",
  "id": "GHSA-gwcr-j4wh-j3cq",
  "modified": "2022-02-08T21:23:08Z",
  "published": "2021-06-10T15:43:22Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/eclipse/jetty.project/security/advisories/GHSA-gwcr-j4wh-j3cq"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-28169"
    },
    {
      "type": "WEB",
      "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
    },
    {
      "type": "WEB",
      "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
    },
    {
      "type": "WEB",
      "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
    },
    {
      "type": "WEB",
      "url": "https://www.debian.org/security/2021/dsa-4949"
    },
    {
      "type": "WEB",
      "url": "https://security.netapp.com/advisory/ntap-20210727-0009"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2021/06/msg00017.html"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/rfff6ff8ffb31e8a32619c79774def44b6ffbb037c128c5ad3eab7171@%3Cissues.zookeeper.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/rf36f1114e84a3379b20587063686148e2d5a39abc0b8a66ff2a9087a@%3Cissues.zookeeper.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/ref1c161a1621504e673f9197b49e6efe5a33ce3f0e6d8f1f804fc695@%3Cjira.kafka.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/rddbb4f8d5db23265bb63d14ef4b3723b438abc1589f877db11d35450@%3Cissues.zookeeper.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/rd5b52362f5edf98e0dcab6541a381f571cccc05ad9188e793af688f3@%3Cjira.kafka.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/rbefa055282d52d6b58d29a79fbb0be65ab0a38d25f00bd29eaf5e6fd@%3Cnotifications.zookeeper.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/rb1292d30462b9baedea7c5d9594fc75990d9aa0ec223b48054ca9c25@%3Cjira.kafka.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/r91e34ff61aff8fd25a3f2a21539597c6ef7589a31c199b0a9546477c@%3Cjira.kafka.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/r8a1a332899a1f92c8118b0895b144b27a78e3f25b9d58a34dd5eb084@%3Cnotifications.zookeeper.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/r67c4f90658fde875521c949448c54c98517beecdc7f618f902c620ec@%3Cissues.zookeeper.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/r33eb06b05afbc7df28d31055cae0cb3fd36cab808c884bf6d680bea5@%3Cdev.zookeeper.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/r32b0b640ad2be3b858f0af51c68a7d5c5a66a462c8bbb93699825cd3@%3Cissues.zookeeper.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/r29678972c3f8164b151fd7a5802785d402e530c09870a82ffc7681a4@%3Cdev.kafka.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/r284de9c5399486dfff12ab9e7323ca720dd7019a9a3e11c8510a7140@%3Cjira.kafka.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/r2721aba31a8562639c4b937150897e24f78f747cdbda8641c0f659fe@%3Cusers.kafka.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/r234f6452297065636356f43654cdacef565b8f9ceb0e0c07ffb8c73b@%3Cdev.kafka.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/r04a4b4553a23aff26f42635a6ae388c3b162aab30a88d12e59d05168@%3Cjira.kafka.apache.org%3E"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/eclipse/jetty.project"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Jetty Utility Servlets ConcatServlet Double Decoding Information Disclosure Vulnerability"
}

{
  "GSD": {
    "alias": "CVE-2021-28169",
    "description": "For Eclipse Jetty versions \u003c= 9.4.40, \u003c= 10.0.2, \u003c= 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory. For example a request to `/concat?/%2557EB-INF/web.xml` can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.",
    "id": "GSD-2021-28169",
    "references": [
      "https://www.suse.com/security/cve/CVE-2021-28169.html",
      "https://www.debian.org/security/2021/dsa-4949",
      "https://access.redhat.com/errata/RHSA-2021:5134",
      "https://access.redhat.com/errata/RHSA-2021:4767",
      "https://access.redhat.com/errata/RHSA-2021:3758",
      "https://access.redhat.com/errata/RHSA-2021:3700",
      "https://access.redhat.com/errata/RHSA-2021:3225",
      "https://access.redhat.com/errata/RHSA-2022:7257"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2021-28169"
      ],
      "details": "For Eclipse Jetty versions \u003c= 9.4.40, \u003c= 10.0.2, \u003c= 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory. For example a request to `/concat?/%2557EB-INF/web.xml` can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.",
      "id": "GSD-2021-28169",
      "modified": "2023-12-13T01:23:29.479928Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "security@eclipse.org",
        "ID": "CVE-2021-28169",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "Eclipse Jetty",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c=",
                          "version_value": "9.4.40"
                        },
                        {
                          "version_affected": "\u003c=",
                          "version_value": "10.0.2"
                        },
                        {
                          "version_affected": "\u003c=",
                          "version_value": "11.0.2"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "The Eclipse Foundation"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "For Eclipse Jetty versions \u003c= 9.4.40, \u003c= 10.0.2, \u003c= 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory. For example a request to `/concat?/%2557EB-INF/web.xml` can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application."
          }
        ]
      },
      "impact": {
        "cvss": {
          "baseScore": 5.3,
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "version": "3.1"
        }
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "CWE-200"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://github.com/eclipse/jetty.project/security/advisories/GHSA-gwcr-j4wh-j3cq",
            "refsource": "CONFIRM",
            "url": "https://github.com/eclipse/jetty.project/security/advisories/GHSA-gwcr-j4wh-j3cq"
          },
          {
            "name": "[kafka-users] 20210617 vulnerabilities",
            "refsource": "MLIST",
            "url": "https://lists.apache.org/thread.html/r2721aba31a8562639c4b937150897e24f78f747cdbda8641c0f659fe@%3Cusers.kafka.apache.org%3E"
          },
          {
            "name": "[debian-lts-announce] 20210617 [SECURITY] [DLA 2688-1] jetty9 security update",
            "refsource": "MLIST",
            "url": "https://lists.debian.org/debian-lts-announce/2021/06/msg00017.html"
          },
          {
            "name": "[kafka-jira] 20210623 [GitHub] [kafka] dongjinleekr opened a new pull request #10919: KAFKA-12985: CVE-2021-28169 - Upgrade jetty to 9.4.41",
            "refsource": "MLIST",
            "url": "https://lists.apache.org/thread.html/ref1c161a1621504e673f9197b49e6efe5a33ce3f0e6d8f1f804fc695@%3Cjira.kafka.apache.org%3E"
          },
          {
            "name": "[kafka-dev] 20210623 [jira] [Created] (KAFKA-12985) CVE-2021-28169 - Upgrade jetty to 9.4.41",
            "refsource": "MLIST",
            "url": "https://lists.apache.org/thread.html/r29678972c3f8164b151fd7a5802785d402e530c09870a82ffc7681a4@%3Cdev.kafka.apache.org%3E"
          },
          {
            "name": "[kafka-jira] 20210623 [jira] [Created] (KAFKA-12985) CVE-2021-28169 - Upgrade jetty to 9.4.41",
            "refsource": "MLIST",
            "url": "https://lists.apache.org/thread.html/r04a4b4553a23aff26f42635a6ae388c3b162aab30a88d12e59d05168@%3Cjira.kafka.apache.org%3E"
          },
          {
            "name": "[kafka-jira] 20210704 [GitHub] [kafka] ijuma commented on pull request #10919: KAFKA-12985: CVE-2021-28169 - Upgrade jetty to 9.4.42",
            "refsource": "MLIST",
            "url": "https://lists.apache.org/thread.html/rd5b52362f5edf98e0dcab6541a381f571cccc05ad9188e793af688f3@%3Cjira.kafka.apache.org%3E"
          },
          {
            "name": "[kafka-jira] 20210704 [GitHub] [kafka] ijuma merged pull request #10919: KAFKA-12985: CVE-2021-28169 - Upgrade jetty to 9.4.42",
            "refsource": "MLIST",
            "url": "https://lists.apache.org/thread.html/r284de9c5399486dfff12ab9e7323ca720dd7019a9a3e11c8510a7140@%3Cjira.kafka.apache.org%3E"
          },
          {
            "name": "[kafka-dev] 20210722 [jira] [Resolved] (KAFKA-12985) CVE-2021-28169 - Upgrade jetty to 9.4.41",
            "refsource": "MLIST",
            "url": "https://lists.apache.org/thread.html/r234f6452297065636356f43654cdacef565b8f9ceb0e0c07ffb8c73b@%3Cdev.kafka.apache.org%3E"
          },
          {
            "name": "[kafka-jira] 20210722 [jira] [Updated] (KAFKA-12985) CVE-2021-28169 - Upgrade jetty to 9.4.42",
            "refsource": "MLIST",
            "url": "https://lists.apache.org/thread.html/r91e34ff61aff8fd25a3f2a21539597c6ef7589a31c199b0a9546477c@%3Cjira.kafka.apache.org%3E"
          },
          {
            "name": "[kafka-jira] 20210722 [jira] [Resolved] (KAFKA-12985) CVE-2021-28169 - Upgrade jetty to 9.4.41",
            "refsource": "MLIST",
            "url": "https://lists.apache.org/thread.html/rb1292d30462b9baedea7c5d9594fc75990d9aa0ec223b48054ca9c25@%3Cjira.kafka.apache.org%3E"
          },
          {
            "name": "DSA-4949",
            "refsource": "DEBIAN",
            "url": "https://www.debian.org/security/2021/dsa-4949"
          },
          {
            "name": "[zookeeper-issues] 20210928 [jira] [Updated] (ZOOKEEPER-4390) CVE-2021-28169 - Upgrade jetty to 9.4.42",
            "refsource": "MLIST",
            "url": "https://lists.apache.org/thread.html/rfff6ff8ffb31e8a32619c79774def44b6ffbb037c128c5ad3eab7171@%3Cissues.zookeeper.apache.org%3E"
          },
          {
            "name": "[zookeeper-issues] 20210928 [jira] [Created] (ZOOKEEPER-4390) CVE-2021-28169 - Upgrade jetty to 9.4.42",
            "refsource": "MLIST",
            "url": "https://lists.apache.org/thread.html/r32b0b640ad2be3b858f0af51c68a7d5c5a66a462c8bbb93699825cd3@%3Cissues.zookeeper.apache.org%3E"
          },
          {
            "name": "[zookeeper-issues] 20210928 [jira] [Updated] (ZOOKEEPER-4390) CVE-2021-28169 , - Upgrade jetty to 9.4.42",
            "refsource": "MLIST",
            "url": "https://lists.apache.org/thread.html/rf36f1114e84a3379b20587063686148e2d5a39abc0b8a66ff2a9087a@%3Cissues.zookeeper.apache.org%3E"
          },
          {
            "name": "[zookeeper-issues] 20210928 [jira] [Updated] (ZOOKEEPER-4390) CVE-2021-28169 , CVE-2021-28163, - Upgrade jetty to 9.4.42",
            "refsource": "MLIST",
            "url": "https://lists.apache.org/thread.html/rddbb4f8d5db23265bb63d14ef4b3723b438abc1589f877db11d35450@%3Cissues.zookeeper.apache.org%3E"
          },
          {
            "name": "[zookeeper-dev] 20210928 [jira] [Created] (ZOOKEEPER-4390) CVE-2021-28169 - Upgrade jetty to 9.4.42",
            "refsource": "MLIST",
            "url": "https://lists.apache.org/thread.html/r33eb06b05afbc7df28d31055cae0cb3fd36cab808c884bf6d680bea5@%3Cdev.zookeeper.apache.org%3E"
          },
          {
            "name": "[zookeeper-issues] 20210928 [jira] [Updated] (ZOOKEEPER-4390) CVE-2021-28169 , CVE-2021-28163, CVE-2021-34428- Upgrade jetty to 9.4.42",
            "refsource": "MLIST",
            "url": "https://lists.apache.org/thread.html/r67c4f90658fde875521c949448c54c98517beecdc7f618f902c620ec@%3Cissues.zookeeper.apache.org%3E"
          },
          {
            "name": "https://www.oracle.com/security-alerts/cpuoct2021.html",
            "refsource": "MISC",
            "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
          },
          {
            "name": "https://lists.apache.org/thread.html/r8a1a332899a1f92c8118b0895b144b27a78e3f25b9d58a34dd5eb084@%3Cnotifications.zookeeper.apache.org%3E",
            "refsource": "MISC",
            "url": "https://lists.apache.org/thread.html/r8a1a332899a1f92c8118b0895b144b27a78e3f25b9d58a34dd5eb084@%3Cnotifications.zookeeper.apache.org%3E"
          },
          {
            "name": "https://lists.apache.org/thread.html/rbefa055282d52d6b58d29a79fbb0be65ab0a38d25f00bd29eaf5e6fd@%3Cnotifications.zookeeper.apache.org%3E",
            "refsource": "MISC",
            "url": "https://lists.apache.org/thread.html/rbefa055282d52d6b58d29a79fbb0be65ab0a38d25f00bd29eaf5e6fd@%3Cnotifications.zookeeper.apache.org%3E"
          },
          {
            "name": "https://security.netapp.com/advisory/ntap-20210727-0009/",
            "refsource": "CONFIRM",
            "url": "https://security.netapp.com/advisory/ntap-20210727-0009/"
          },
          {
            "name": "https://www.oracle.com/security-alerts/cpujan2022.html",
            "refsource": "MISC",
            "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
          },
          {
            "name": "https://www.oracle.com/security-alerts/cpuapr2022.html",
            "refsource": "MISC",
            "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
          }
        ]
      }
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "[3.5.9]",
          "affected_versions": "Version 3.5.9",
          "cvss_v2": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "cwe_ids": [
            "CWE-1035",
            "CWE-200",
            "CWE-937"
          ],
          "date": "2022-02-07",
          "description": "It is possible for requests to the `ConcatServlet` with a doubly encoded path to access protected resources within the WEB-INF directory. For example a request to `/concat?/%2557EB-INF/web.xml` can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.",
          "fixed_versions": [
            "3.6.0"
          ],
          "identifier": "CVE-2021-28169",
          "identifiers": [
            "CVE-2021-28169",
            "GHSA-gwcr-j4wh-j3cq"
          ],
          "not_impacted": "All versions before 3.5.9, all versions after 3.5.9",
          "package_slug": "maven/org.apache.zookeeper/zookeeper",
          "pubdate": "2021-06-09",
          "solution": "Upgrade to version 3.6.0 or above.",
          "title": "Exposure of Sensitive Information to an Unauthorized Actor",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2021-28169",
            "https://github.com/eclipse/jetty.project/security/advisories/GHSA-gwcr-j4wh-j3cq",
            "https://lists.debian.org/debian-lts-announce/2021/06/msg00017.html",
            "https://security.netapp.com/advisory/ntap-20210727-0009/",
            "https://www.debian.org/security/2021/dsa-4949",
            "https://lists.apache.org/thread.html/r32b0b640ad2be3b858f0af51c68a7d5c5a66a462c8bbb93699825cd3@%3Cissues.zookeeper.apache.org%3E",
            "https://lists.apache.org/thread.html/r67c4f90658fde875521c949448c54c98517beecdc7f618f902c620ec@%3Cissues.zookeeper.apache.org%3E",
            "https://lists.apache.org/thread.html/rddbb4f8d5db23265bb63d14ef4b3723b438abc1589f877db11d35450@%3Cissues.zookeeper.apache.org%3E",
            "https://lists.apache.org/thread.html/rfff6ff8ffb31e8a32619c79774def44b6ffbb037c128c5ad3eab7171@%3Cissues.zookeeper.apache.org%3E",
            "https://lists.apache.org/thread.html/rf36f1114e84a3379b20587063686148e2d5a39abc0b8a66ff2a9087a@%3Cissues.zookeeper.apache.org%3E",
            "https://lists.apache.org/thread.html/r33eb06b05afbc7df28d31055cae0cb3fd36cab808c884bf6d680bea5@%3Cdev.zookeeper.apache.org%3E",
            "https://lists.apache.org/thread.html/r8a1a332899a1f92c8118b0895b144b27a78e3f25b9d58a34dd5eb084@%3Cnotifications.zookeeper.apache.org%3E",
            "https://lists.apache.org/thread.html/rbefa055282d52d6b58d29a79fbb0be65ab0a38d25f00bd29eaf5e6fd@%3Cnotifications.zookeeper.apache.org%3E",
            "https://www.oracle.com/security-alerts/cpuoct2021.html"
          ],
          "uuid": "58d70ae5-9723-4331-ab9b-b9ed61fa3f57"
        },
        {
          "affected_range": "(,9.4.41),[10.0.0,10.0.3),[11.0.0,11.0.3)",
          "affected_versions": "All versions before 9.4.41, all versions starting from 10.0.0 before 10.0.3, all versions starting from 11.0.0 before 11.0.3",
          "cvss_v2": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "cwe_ids": [
            "CWE-1035",
            "CWE-937"
          ],
          "date": "2022-10-25",
          "description": "In Eclipse Jetty it is possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory. For example a request to `/concat?/%2557EB-INF/web.xml` can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.",
          "fixed_versions": [
            "9.4.41",
            "10.0.3",
            "11.0.3"
          ],
          "identifier": "CVE-2021-28169",
          "identifiers": [
            "CVE-2021-28169",
            "GHSA-gwcr-j4wh-j3cq"
          ],
          "not_impacted": "",
          "package_slug": "maven/org.eclipse.jetty/jetty-servlets",
          "pubdate": "2021-06-09",
          "solution": "Upgrade to versions 9.4.41, 10.0.3, 11.0.3 or above.",
          "title": "Information Exposure",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2021-28169"
          ],
          "uuid": "ae25215f-b496-47e9-a765-e85ca2858cd1"
        }
      ]
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "9.4.41",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "10.0.3",
                "versionStartIncluding": "10.0.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "11.0.3",
                "versionStartIncluding": "11.0.0",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:oracle:rest_data_services:*:*:*:*:-:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "21.3",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.14.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:netapp:snap_creator_framework:-:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:netapp:hci:-:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:netapp:management_services_for_element_software:-:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "security@eclipse.org",
          "ID": "CVE-2021-28169"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "For Eclipse Jetty versions \u003c= 9.4.40, \u003c= 10.0.2, \u003c= 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory. For example a request to `/concat?/%2557EB-INF/web.xml` can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "NVD-CWE-Other"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/eclipse/jetty.project/security/advisories/GHSA-gwcr-j4wh-j3cq",
              "refsource": "CONFIRM",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://github.com/eclipse/jetty.project/security/advisories/GHSA-gwcr-j4wh-j3cq"
            },
            {
              "name": "[kafka-users] 20210617 vulnerabilities",
              "refsource": "MLIST",
              "tags": [
                "Mailing List",
                "Third Party Advisory"
              ],
              "url": "https://lists.apache.org/thread.html/r2721aba31a8562639c4b937150897e24f78f747cdbda8641c0f659fe@%3Cusers.kafka.apache.org%3E"
            },
            {
              "name": "[debian-lts-announce] 20210617 [SECURITY] [DLA 2688-1] jetty9 security update",
              "refsource": "MLIST",
              "tags": [
                "Mailing List",
                "Third Party Advisory"
              ],
              "url": "https://lists.debian.org/debian-lts-announce/2021/06/msg00017.html"
            },
            {
              "name": "[kafka-jira] 20210623 [GitHub] [kafka] dongjinleekr opened a new pull request #10919: KAFKA-12985: CVE-2021-28169 - Upgrade jetty to 9.4.41",
              "refsource": "MLIST",
              "tags": [
                "Mailing List",
                "Third Party Advisory"
              ],
              "url": "https://lists.apache.org/thread.html/ref1c161a1621504e673f9197b49e6efe5a33ce3f0e6d8f1f804fc695@%3Cjira.kafka.apache.org%3E"
            },
            {
              "name": "[kafka-dev] 20210623 [jira] [Created] (KAFKA-12985) CVE-2021-28169 - Upgrade jetty to 9.4.41",
              "refsource": "MLIST",
              "tags": [
                "Mailing List",
                "Third Party Advisory"
              ],
              "url": "https://lists.apache.org/thread.html/r29678972c3f8164b151fd7a5802785d402e530c09870a82ffc7681a4@%3Cdev.kafka.apache.org%3E"
            },
            {
              "name": "[kafka-jira] 20210623 [jira] [Created] (KAFKA-12985) CVE-2021-28169 - Upgrade jetty to 9.4.41",
              "refsource": "MLIST",
              "tags": [
                "Mailing List",
                "Third Party Advisory"
              ],
              "url": "https://lists.apache.org/thread.html/r04a4b4553a23aff26f42635a6ae388c3b162aab30a88d12e59d05168@%3Cjira.kafka.apache.org%3E"
            },
            {
              "name": "[kafka-jira] 20210704 [GitHub] [kafka] ijuma merged pull request #10919: KAFKA-12985: CVE-2021-28169 - Upgrade jetty to 9.4.42",
              "refsource": "MLIST",
              "tags": [
                "Mailing List",
                "Third Party Advisory"
              ],
              "url": "https://lists.apache.org/thread.html/r284de9c5399486dfff12ab9e7323ca720dd7019a9a3e11c8510a7140@%3Cjira.kafka.apache.org%3E"
            },
            {
              "name": "[kafka-jira] 20210704 [GitHub] [kafka] ijuma commented on pull request #10919: KAFKA-12985: CVE-2021-28169 - Upgrade jetty to 9.4.42",
              "refsource": "MLIST",
              "tags": [
                "Mailing List",
                "Third Party Advisory"
              ],
              "url": "https://lists.apache.org/thread.html/rd5b52362f5edf98e0dcab6541a381f571cccc05ad9188e793af688f3@%3Cjira.kafka.apache.org%3E"
            },
            {
              "name": "[kafka-dev] 20210722 [jira] [Resolved] (KAFKA-12985) CVE-2021-28169 - Upgrade jetty to 9.4.41",
              "refsource": "MLIST",
              "tags": [
                "Mailing List",
                "Third Party Advisory"
              ],
              "url": "https://lists.apache.org/thread.html/r234f6452297065636356f43654cdacef565b8f9ceb0e0c07ffb8c73b@%3Cdev.kafka.apache.org%3E"
            },
            {
              "name": "[kafka-jira] 20210722 [jira] [Resolved] (KAFKA-12985) CVE-2021-28169 - Upgrade jetty to 9.4.41",
              "refsource": "MLIST",
              "tags": [
                "Mailing List",
                "Third Party Advisory"
              ],
              "url": "https://lists.apache.org/thread.html/rb1292d30462b9baedea7c5d9594fc75990d9aa0ec223b48054ca9c25@%3Cjira.kafka.apache.org%3E"
            },
            {
              "name": "[kafka-jira] 20210722 [jira] [Updated] (KAFKA-12985) CVE-2021-28169 - Upgrade jetty to 9.4.42",
              "refsource": "MLIST",
              "tags": [
                "Mailing List",
                "Third Party Advisory"
              ],
              "url": "https://lists.apache.org/thread.html/r91e34ff61aff8fd25a3f2a21539597c6ef7589a31c199b0a9546477c@%3Cjira.kafka.apache.org%3E"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20210727-0009/",
              "refsource": "CONFIRM",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://security.netapp.com/advisory/ntap-20210727-0009/"
            },
            {
              "name": "DSA-4949",
              "refsource": "DEBIAN",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://www.debian.org/security/2021/dsa-4949"
            },
            {
              "name": "[zookeeper-issues] 20210928 [jira] [Created] (ZOOKEEPER-4390) CVE-2021-28169 - Upgrade jetty to 9.4.42",
              "refsource": "MLIST",
              "tags": [
                "Mailing List",
                "Third Party Advisory"
              ],
              "url": "https://lists.apache.org/thread.html/r32b0b640ad2be3b858f0af51c68a7d5c5a66a462c8bbb93699825cd3@%3Cissues.zookeeper.apache.org%3E"
            },
            {
              "name": "[zookeeper-issues] 20210928 [jira] [Updated] (ZOOKEEPER-4390) CVE-2021-28169 , CVE-2021-28163, CVE-2021-34428- Upgrade jetty to 9.4.42",
              "refsource": "MLIST",
              "tags": [
                "Mailing List",
                "Third Party Advisory"
              ],
              "url": "https://lists.apache.org/thread.html/r67c4f90658fde875521c949448c54c98517beecdc7f618f902c620ec@%3Cissues.zookeeper.apache.org%3E"
            },
            {
              "name": "[zookeeper-issues] 20210928 [jira] [Updated] (ZOOKEEPER-4390) CVE-2021-28169 , CVE-2021-28163, - Upgrade jetty to 9.4.42",
              "refsource": "MLIST",
              "tags": [
                "Mailing List",
                "Third Party Advisory"
              ],
              "url": "https://lists.apache.org/thread.html/rddbb4f8d5db23265bb63d14ef4b3723b438abc1589f877db11d35450@%3Cissues.zookeeper.apache.org%3E"
            },
            {
              "name": "[zookeeper-issues] 20210928 [jira] [Updated] (ZOOKEEPER-4390) CVE-2021-28169 - Upgrade jetty to 9.4.42",
              "refsource": "MLIST",
              "tags": [
                "Mailing List",
                "Third Party Advisory"
              ],
              "url": "https://lists.apache.org/thread.html/rfff6ff8ffb31e8a32619c79774def44b6ffbb037c128c5ad3eab7171@%3Cissues.zookeeper.apache.org%3E"
            },
            {
              "name": "[zookeeper-issues] 20210928 [jira] [Updated] (ZOOKEEPER-4390) CVE-2021-28169 , - Upgrade jetty to 9.4.42",
              "refsource": "MLIST",
              "tags": [
                "Mailing List",
                "Third Party Advisory"
              ],
              "url": "https://lists.apache.org/thread.html/rf36f1114e84a3379b20587063686148e2d5a39abc0b8a66ff2a9087a@%3Cissues.zookeeper.apache.org%3E"
            },
            {
              "name": "[zookeeper-dev] 20210928 [jira] [Created] (ZOOKEEPER-4390) CVE-2021-28169 - Upgrade jetty to 9.4.42",
              "refsource": "MLIST",
              "tags": [
                "Mailing List",
                "Third Party Advisory"
              ],
              "url": "https://lists.apache.org/thread.html/r33eb06b05afbc7df28d31055cae0cb3fd36cab808c884bf6d680bea5@%3Cdev.zookeeper.apache.org%3E"
            },
            {
              "name": "https://lists.apache.org/thread.html/r8a1a332899a1f92c8118b0895b144b27a78e3f25b9d58a34dd5eb084@%3Cnotifications.zookeeper.apache.org%3E",
              "refsource": "MISC",
              "tags": [
                "Mailing List",
                "Third Party Advisory"
              ],
              "url": "https://lists.apache.org/thread.html/r8a1a332899a1f92c8118b0895b144b27a78e3f25b9d58a34dd5eb084@%3Cnotifications.zookeeper.apache.org%3E"
            },
            {
              "name": "https://lists.apache.org/thread.html/rbefa055282d52d6b58d29a79fbb0be65ab0a38d25f00bd29eaf5e6fd@%3Cnotifications.zookeeper.apache.org%3E",
              "refsource": "MISC",
              "tags": [
                "Mailing List",
                "Third Party Advisory"
              ],
              "url": "https://lists.apache.org/thread.html/rbefa055282d52d6b58d29a79fbb0be65ab0a38d25f00bd29eaf5e6fd@%3Cnotifications.zookeeper.apache.org%3E"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpuoct2021.html",
              "refsource": "MISC",
              "tags": [
                "Patch",
                "Third Party Advisory"
              ],
              "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpujan2022.html",
              "refsource": "MISC",
              "tags": [
                "Patch",
                "Third Party Advisory"
              ],
              "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpuapr2022.html",
              "refsource": "MISC",
              "tags": [
                "Patch",
                "Third Party Advisory"
              ],
              "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "acInsufInfo": false,
          "cvssV2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 5.0,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          "exploitabilityScore": 10.0,
          "impactScore": 2.9,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "MEDIUM",
          "userInteractionRequired": false
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 1.4
        }
      },
      "lastModifiedDate": "2022-10-25T23:40Z",
      "publishedDate": "2021-06-09T02:15Z"
    }
  }
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for jetty-minimal",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for jetty-minimal fixes the following issues:\n\nUpdate to version 9.4.42.v20210604\n\n- Fix: bsc#1187117, CVE-2021-28169 - possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory\n- Fix: bsc#1184367, CVE-2021-28165 - jetty server high CPU when client send data length \u003e 17408\n- Fix: bsc#1184368, CVE-2021-28164 - Normalize ambiguous URIs\n- Fix: bsc#1184366, CVE-2021-28163 - Exclude webapps directory from deployment scan\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-SLE-15.3-2021-2005",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2021_2005-1.json"
      },
      {
        "category": "self",
        "summary": "URL for openSUSE-SU-2021:2005-1",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/U4KKN3NUA6VAZ6XTFLI3KB3IHAPVD46L/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for openSUSE-SU-2021:2005-1",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/U4KKN3NUA6VAZ6XTFLI3KB3IHAPVD46L/"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1184366",
        "url": "https://bugzilla.suse.com/1184366"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1184367",
        "url": "https://bugzilla.suse.com/1184367"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1184368",
        "url": "https://bugzilla.suse.com/1184368"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1187117",
        "url": "https://bugzilla.suse.com/1187117"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2021-28163 page",
        "url": "https://www.suse.com/security/cve/CVE-2021-28163/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2021-28164 page",
        "url": "https://www.suse.com/security/cve/CVE-2021-28164/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2021-28165 page",
        "url": "https://www.suse.com/security/cve/CVE-2021-28165/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2021-28169 page",
        "url": "https://www.suse.com/security/cve/CVE-2021-28169/"
      }
    ],
    "title": "Security update for jetty-minimal",
    "tracking": {
      "current_release_date": "2021-07-11T08:05:38Z",
      "generator": {
        "date": "2021-07-11T08:05:38Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2021:2005-1",
      "initial_release_date": "2021-07-11T08:05:38Z",
      "revision_history": [
        {
          "date": "2021-07-11T08:05:38Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "jetty-annotations-9.4.42-3.9.1.noarch",
                "product": {
                  "name": "jetty-annotations-9.4.42-3.9.1.noarch",
                  "product_id": "jetty-annotations-9.4.42-3.9.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "jetty-client-9.4.42-3.9.1.noarch",
                "product": {
                  "name": "jetty-client-9.4.42-3.9.1.noarch",
                  "product_id": "jetty-client-9.4.42-3.9.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "jetty-continuation-9.4.42-3.9.1.noarch",
                "product": {
                  "name": "jetty-continuation-9.4.42-3.9.1.noarch",
                  "product_id": "jetty-continuation-9.4.42-3.9.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "jetty-http-9.4.42-3.9.1.noarch",
                "product": {
                  "name": "jetty-http-9.4.42-3.9.1.noarch",
                  "product_id": "jetty-http-9.4.42-3.9.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "jetty-io-9.4.42-3.9.1.noarch",
                "product": {
                  "name": "jetty-io-9.4.42-3.9.1.noarch",
                  "product_id": "jetty-io-9.4.42-3.9.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "jetty-jaas-9.4.42-3.9.1.noarch",
                "product": {
                  "name": "jetty-jaas-9.4.42-3.9.1.noarch",
                  "product_id": "jetty-jaas-9.4.42-3.9.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "jetty-javax-websocket-client-impl-9.4.42-3.9.1.noarch",
                "product": {
                  "name": "jetty-javax-websocket-client-impl-9.4.42-3.9.1.noarch",
                  "product_id": "jetty-javax-websocket-client-impl-9.4.42-3.9.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "jetty-javax-websocket-server-impl-9.4.42-3.9.1.noarch",
                "product": {
                  "name": "jetty-javax-websocket-server-impl-9.4.42-3.9.1.noarch",
                  "product_id": "jetty-javax-websocket-server-impl-9.4.42-3.9.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "jetty-jmx-9.4.42-3.9.1.noarch",
                "product": {
                  "name": "jetty-jmx-9.4.42-3.9.1.noarch",
                  "product_id": "jetty-jmx-9.4.42-3.9.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "jetty-jndi-9.4.42-3.9.1.noarch",
                "product": {
                  "name": "jetty-jndi-9.4.42-3.9.1.noarch",
                  "product_id": "jetty-jndi-9.4.42-3.9.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "jetty-jsp-9.4.42-3.9.1.noarch",
                "product": {
                  "name": "jetty-jsp-9.4.42-3.9.1.noarch",
                  "product_id": "jetty-jsp-9.4.42-3.9.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "jetty-minimal-javadoc-9.4.42-3.9.1.noarch",
                "product": {
                  "name": "jetty-minimal-javadoc-9.4.42-3.9.1.noarch",
                  "product_id": "jetty-minimal-javadoc-9.4.42-3.9.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "jetty-openid-9.4.42-3.9.1.noarch",
                "product": {
                  "name": "jetty-openid-9.4.42-3.9.1.noarch",
                  "product_id": "jetty-openid-9.4.42-3.9.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "jetty-plus-9.4.42-3.9.1.noarch",
                "product": {
                  "name": "jetty-plus-9.4.42-3.9.1.noarch",
                  "product_id": "jetty-plus-9.4.42-3.9.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "jetty-proxy-9.4.42-3.9.1.noarch",
                "product": {
                  "name": "jetty-proxy-9.4.42-3.9.1.noarch",
                  "product_id": "jetty-proxy-9.4.42-3.9.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "jetty-security-9.4.42-3.9.1.noarch",
                "product": {
                  "name": "jetty-security-9.4.42-3.9.1.noarch",
                  "product_id": "jetty-security-9.4.42-3.9.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "jetty-server-9.4.42-3.9.1.noarch",
                "product": {
                  "name": "jetty-server-9.4.42-3.9.1.noarch",
                  "product_id": "jetty-server-9.4.42-3.9.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "jetty-servlet-9.4.42-3.9.1.noarch",
                "product": {
                  "name": "jetty-servlet-9.4.42-3.9.1.noarch",
                  "product_id": "jetty-servlet-9.4.42-3.9.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "jetty-util-9.4.42-3.9.1.noarch",
                "product": {
                  "name": "jetty-util-9.4.42-3.9.1.noarch",
                  "product_id": "jetty-util-9.4.42-3.9.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "jetty-util-ajax-9.4.42-3.9.1.noarch",
                "product": {
                  "name": "jetty-util-ajax-9.4.42-3.9.1.noarch",
                  "product_id": "jetty-util-ajax-9.4.42-3.9.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "jetty-webapp-9.4.42-3.9.1.noarch",
                "product": {
                  "name": "jetty-webapp-9.4.42-3.9.1.noarch",
                  "product_id": "jetty-webapp-9.4.42-3.9.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "jetty-websocket-api-9.4.42-3.9.1.noarch",
                "product": {
                  "name": "jetty-websocket-api-9.4.42-3.9.1.noarch",
                  "product_id": "jetty-websocket-api-9.4.42-3.9.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "jetty-websocket-client-9.4.42-3.9.1.noarch",
                "product": {
                  "name": "jetty-websocket-client-9.4.42-3.9.1.noarch",
                  "product_id": "jetty-websocket-client-9.4.42-3.9.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "jetty-websocket-common-9.4.42-3.9.1.noarch",
                "product": {
                  "name": "jetty-websocket-common-9.4.42-3.9.1.noarch",
                  "product_id": "jetty-websocket-common-9.4.42-3.9.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "jetty-websocket-javadoc-9.4.42-3.9.1.noarch",
                "product": {
                  "name": "jetty-websocket-javadoc-9.4.42-3.9.1.noarch",
                  "product_id": "jetty-websocket-javadoc-9.4.42-3.9.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "jetty-websocket-server-9.4.42-3.9.1.noarch",
                "product": {
                  "name": "jetty-websocket-server-9.4.42-3.9.1.noarch",
                  "product_id": "jetty-websocket-server-9.4.42-3.9.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "jetty-websocket-servlet-9.4.42-3.9.1.noarch",
                "product": {
                  "name": "jetty-websocket-servlet-9.4.42-3.9.1.noarch",
                  "product_id": "jetty-websocket-servlet-9.4.42-3.9.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "jetty-xml-9.4.42-3.9.1.noarch",
                "product": {
                  "name": "jetty-xml-9.4.42-3.9.1.noarch",
                  "product_id": "jetty-xml-9.4.42-3.9.1.noarch"
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Leap 15.3",
                "product": {
                  "name": "openSUSE Leap 15.3",
                  "product_id": "openSUSE Leap 15.3",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:leap:15.3"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jetty-annotations-9.4.42-3.9.1.noarch as component of openSUSE Leap 15.3",
          "product_id": "openSUSE Leap 15.3:jetty-annotations-9.4.42-3.9.1.noarch"
        },
        "product_reference": "jetty-annotations-9.4.42-3.9.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jetty-client-9.4.42-3.9.1.noarch as component of openSUSE Leap 15.3",
          "product_id": "openSUSE Leap 15.3:jetty-client-9.4.42-3.9.1.noarch"
        },
        "product_reference": "jetty-client-9.4.42-3.9.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jetty-continuation-9.4.42-3.9.1.noarch as component of openSUSE Leap 15.3",
          "product_id": "openSUSE Leap 15.3:jetty-continuation-9.4.42-3.9.1.noarch"
        },
        "product_reference": "jetty-continuation-9.4.42-3.9.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jetty-http-9.4.42-3.9.1.noarch as component of openSUSE Leap 15.3",
          "product_id": "openSUSE Leap 15.3:jetty-http-9.4.42-3.9.1.noarch"
        },
        "product_reference": "jetty-http-9.4.42-3.9.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jetty-io-9.4.42-3.9.1.noarch as component of openSUSE Leap 15.3",
          "product_id": "openSUSE Leap 15.3:jetty-io-9.4.42-3.9.1.noarch"
        },
        "product_reference": "jetty-io-9.4.42-3.9.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jetty-jaas-9.4.42-3.9.1.noarch as component of openSUSE Leap 15.3",
          "product_id": "openSUSE Leap 15.3:jetty-jaas-9.4.42-3.9.1.noarch"
        },
        "product_reference": "jetty-jaas-9.4.42-3.9.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jetty-javax-websocket-client-impl-9.4.42-3.9.1.noarch as component of openSUSE Leap 15.3",
          "product_id": "openSUSE Leap 15.3:jetty-javax-websocket-client-impl-9.4.42-3.9.1.noarch"
        },
        "product_reference": "jetty-javax-websocket-client-impl-9.4.42-3.9.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jetty-javax-websocket-server-impl-9.4.42-3.9.1.noarch as component of openSUSE Leap 15.3",
          "product_id": "openSUSE Leap 15.3:jetty-javax-websocket-server-impl-9.4.42-3.9.1.noarch"
        },
        "product_reference": "jetty-javax-websocket-server-impl-9.4.42-3.9.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jetty-jmx-9.4.42-3.9.1.noarch as component of openSUSE Leap 15.3",
          "product_id": "openSUSE Leap 15.3:jetty-jmx-9.4.42-3.9.1.noarch"
        },
        "product_reference": "jetty-jmx-9.4.42-3.9.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jetty-jndi-9.4.42-3.9.1.noarch as component of openSUSE Leap 15.3",
          "product_id": "openSUSE Leap 15.3:jetty-jndi-9.4.42-3.9.1.noarch"
        },
        "product_reference": "jetty-jndi-9.4.42-3.9.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jetty-jsp-9.4.42-3.9.1.noarch as component of openSUSE Leap 15.3",
          "product_id": "openSUSE Leap 15.3:jetty-jsp-9.4.42-3.9.1.noarch"
        },
        "product_reference": "jetty-jsp-9.4.42-3.9.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jetty-minimal-javadoc-9.4.42-3.9.1.noarch as component of openSUSE Leap 15.3",
          "product_id": "openSUSE Leap 15.3:jetty-minimal-javadoc-9.4.42-3.9.1.noarch"
        },
        "product_reference": "jetty-minimal-javadoc-9.4.42-3.9.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jetty-openid-9.4.42-3.9.1.noarch as component of openSUSE Leap 15.3",
          "product_id": "openSUSE Leap 15.3:jetty-openid-9.4.42-3.9.1.noarch"
        },
        "product_reference": "jetty-openid-9.4.42-3.9.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jetty-plus-9.4.42-3.9.1.noarch as component of openSUSE Leap 15.3",
          "product_id": "openSUSE Leap 15.3:jetty-plus-9.4.42-3.9.1.noarch"
        },
        "product_reference": "jetty-plus-9.4.42-3.9.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jetty-proxy-9.4.42-3.9.1.noarch as component of openSUSE Leap 15.3",
          "product_id": "openSUSE Leap 15.3:jetty-proxy-9.4.42-3.9.1.noarch"
        },
        "product_reference": "jetty-proxy-9.4.42-3.9.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jetty-security-9.4.42-3.9.1.noarch as component of openSUSE Leap 15.3",
          "product_id": "openSUSE Leap 15.3:jetty-security-9.4.42-3.9.1.noarch"
        },
        "product_reference": "jetty-security-9.4.42-3.9.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jetty-server-9.4.42-3.9.1.noarch as component of openSUSE Leap 15.3",
          "product_id": "openSUSE Leap 15.3:jetty-server-9.4.42-3.9.1.noarch"
        },
        "product_reference": "jetty-server-9.4.42-3.9.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jetty-servlet-9.4.42-3.9.1.noarch as component of openSUSE Leap 15.3",
          "product_id": "openSUSE Leap 15.3:jetty-servlet-9.4.42-3.9.1.noarch"
        },
        "product_reference": "jetty-servlet-9.4.42-3.9.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jetty-util-9.4.42-3.9.1.noarch as component of openSUSE Leap 15.3",
          "product_id": "openSUSE Leap 15.3:jetty-util-9.4.42-3.9.1.noarch"
        },
        "product_reference": "jetty-util-9.4.42-3.9.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jetty-util-ajax-9.4.42-3.9.1.noarch as component of openSUSE Leap 15.3",
          "product_id": "openSUSE Leap 15.3:jetty-util-ajax-9.4.42-3.9.1.noarch"
        },
        "product_reference": "jetty-util-ajax-9.4.42-3.9.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jetty-webapp-9.4.42-3.9.1.noarch as component of openSUSE Leap 15.3",
          "product_id": "openSUSE Leap 15.3:jetty-webapp-9.4.42-3.9.1.noarch"
        },
        "product_reference": "jetty-webapp-9.4.42-3.9.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jetty-websocket-api-9.4.42-3.9.1.noarch as component of openSUSE Leap 15.3",
          "product_id": "openSUSE Leap 15.3:jetty-websocket-api-9.4.42-3.9.1.noarch"
        },
        "product_reference": "jetty-websocket-api-9.4.42-3.9.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jetty-websocket-client-9.4.42-3.9.1.noarch as component of openSUSE Leap 15.3",
          "product_id": "openSUSE Leap 15.3:jetty-websocket-client-9.4.42-3.9.1.noarch"
        },
        "product_reference": "jetty-websocket-client-9.4.42-3.9.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jetty-websocket-common-9.4.42-3.9.1.noarch as component of openSUSE Leap 15.3",
          "product_id": "openSUSE Leap 15.3:jetty-websocket-common-9.4.42-3.9.1.noarch"
        },
        "product_reference": "jetty-websocket-common-9.4.42-3.9.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jetty-websocket-javadoc-9.4.42-3.9.1.noarch as component of openSUSE Leap 15.3",
          "product_id": "openSUSE Leap 15.3:jetty-websocket-javadoc-9.4.42-3.9.1.noarch"
        },
        "product_reference": "jetty-websocket-javadoc-9.4.42-3.9.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jetty-websocket-server-9.4.42-3.9.1.noarch as component of openSUSE Leap 15.3",
          "product_id": "openSUSE Leap 15.3:jetty-websocket-server-9.4.42-3.9.1.noarch"
        },
        "product_reference": "jetty-websocket-server-9.4.42-3.9.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jetty-websocket-servlet-9.4.42-3.9.1.noarch as component of openSUSE Leap 15.3",
          "product_id": "openSUSE Leap 15.3:jetty-websocket-servlet-9.4.42-3.9.1.noarch"
        },
        "product_reference": "jetty-websocket-servlet-9.4.42-3.9.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jetty-xml-9.4.42-3.9.1.noarch as component of openSUSE Leap 15.3",
          "product_id": "openSUSE Leap 15.3:jetty-xml-9.4.42-3.9.1.noarch"
        },
        "product_reference": "jetty-xml-9.4.42-3.9.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.3"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2021-28163",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2021-28163"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In Eclipse Jetty 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to 11.0.1, if a user uses a webapps directory that is a symlink, the contents of the webapps directory is deployed as a static webapp, inadvertently serving the webapps themselves and anything else that might be in that directory.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.3:jetty-annotations-9.4.42-3.9.1.noarch",
          "openSUSE Leap 15.3:jetty-client-9.4.42-3.9.1.noarch",
          "openSUSE Leap 15.3:jetty-continuation-9.4.42-3.9.1.noarch",
          "openSUSE Leap 15.3:jetty-http-9.4.42-3.9.1.noarch",
          "openSUSE Leap 15.3:jetty-io-9.4.42-3.9.1.noarch",
          "openSUSE Leap 15.3:jetty-jaas-9.4.42-3.9.1.noarch",
          "openSUSE Leap 15.3:jetty-javax-websocket-client-impl-9.4.42-3.9.1.noarch",
          "openSUSE Leap 15.3:jetty-javax-websocket-server-impl-9.4.42-3.9.1.noarch",
          "openSUSE Leap 15.3:jetty-jmx-9.4.42-3.9.1.noarch",
          "openSUSE Leap 15.3:jetty-jndi-9.4.42-3.9.1.noarch",
          "openSUSE Leap 15.3:jetty-jsp-9.4.42-3.9.1.noarch",
          "openSUSE Leap 15.3:jetty-minimal-javadoc-9.4.42-3.9.1.noarch",
          "openSUSE Leap 15.3:jetty-openid-9.4.42-3.9.1.noarch",
          "openSUSE Leap 15.3:jetty-plus-9.4.42-3.9.1.noarch",
          "openSUSE Leap 15.3:jetty-proxy-9.4.42-3.9.1.noarch",
          "openSUSE Leap 15.3:jetty-security-9.4.42-3.9.1.noarch",
          "openSUSE Leap 15.3:jetty-server-9.4.42-3.9.1.noarch",
          "openSUSE Leap 15.3:jetty-servlet-9.4.42-3.9.1.noarch",
          "openSUSE Leap 15.3:jetty-util-9.4.42-3.9.1.noarch",
          "openSUSE Leap 15.3:jetty-util-ajax-9.4.42-3.9.1.noarch",
          "openSUSE Leap 15.3:jetty-webapp-9.4.42-3.9.1.noarch",
          "openSUSE Leap 15.3:jetty-websocket-api-9.4.42-3.9.1.noarch",
          "openSUSE Leap 15.3:jetty-websocket-client-9.4.42-3.9.1.noarch",
          "openSUSE Leap 15.3:jetty-websocket-common-9.4.42-3.9.1.noarch",
          "openSUSE Leap 15.3:jetty-websocket-javadoc-9.4.42-3.9.1.noarch",
          "openSUSE Leap 15.3:jetty-websocket-server-9.4.42-3.9.1.noarch",
          "openSUSE Leap 15.3:jetty-websocket-servlet-9.4.42-3.9.1.noarch",
          "openSUSE Leap 15.3:jetty-xml-9.4.42-3.9.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2021-28163",
          "url": "https://www.suse.com/security/cve/CVE-2021-28163"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1184366 for CVE-2021-28163",
          "url": "https://bugzilla.suse.com/1184366"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.3:jetty-annotations-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-client-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-continuation-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-http-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-io-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-jaas-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-javax-websocket-client-impl-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-javax-websocket-server-impl-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-jmx-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-jndi-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-jsp-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-minimal-javadoc-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-openid-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-plus-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-proxy-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-security-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-server-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-servlet-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-util-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-util-ajax-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-webapp-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-websocket-api-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-websocket-client-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-websocket-common-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-websocket-javadoc-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-websocket-server-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-websocket-servlet-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-xml-9.4.42-3.9.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.3:jetty-annotations-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-client-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-continuation-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-http-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-io-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-jaas-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-javax-websocket-client-impl-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-javax-websocket-server-impl-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-jmx-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-jndi-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-jsp-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-minimal-javadoc-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-openid-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-plus-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-proxy-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-security-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-server-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-servlet-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-util-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-util-ajax-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-webapp-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-websocket-api-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-websocket-client-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-websocket-common-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-websocket-javadoc-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-websocket-server-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-websocket-servlet-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-xml-9.4.42-3.9.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-07-11T08:05:38Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2021-28163"
    },
    {
      "cve": "CVE-2021-28164",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2021-28164"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF directory. For example a request to /context/%2e/WEB-INF/web.xml can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.3:jetty-annotations-9.4.42-3.9.1.noarch",
          "openSUSE Leap 15.3:jetty-client-9.4.42-3.9.1.noarch",
          "openSUSE Leap 15.3:jetty-continuation-9.4.42-3.9.1.noarch",
          "openSUSE Leap 15.3:jetty-http-9.4.42-3.9.1.noarch",
          "openSUSE Leap 15.3:jetty-io-9.4.42-3.9.1.noarch",
          "openSUSE Leap 15.3:jetty-jaas-9.4.42-3.9.1.noarch",
          "openSUSE Leap 15.3:jetty-javax-websocket-client-impl-9.4.42-3.9.1.noarch",
          "openSUSE Leap 15.3:jetty-javax-websocket-server-impl-9.4.42-3.9.1.noarch",
          "openSUSE Leap 15.3:jetty-jmx-9.4.42-3.9.1.noarch",
          "openSUSE Leap 15.3:jetty-jndi-9.4.42-3.9.1.noarch",
          "openSUSE Leap 15.3:jetty-jsp-9.4.42-3.9.1.noarch",
          "openSUSE Leap 15.3:jetty-minimal-javadoc-9.4.42-3.9.1.noarch",
          "openSUSE Leap 15.3:jetty-openid-9.4.42-3.9.1.noarch",
          "openSUSE Leap 15.3:jetty-plus-9.4.42-3.9.1.noarch",
          "openSUSE Leap 15.3:jetty-proxy-9.4.42-3.9.1.noarch",
          "openSUSE Leap 15.3:jetty-security-9.4.42-3.9.1.noarch",
          "openSUSE Leap 15.3:jetty-server-9.4.42-3.9.1.noarch",
          "openSUSE Leap 15.3:jetty-servlet-9.4.42-3.9.1.noarch",
          "openSUSE Leap 15.3:jetty-util-9.4.42-3.9.1.noarch",
          "openSUSE Leap 15.3:jetty-util-ajax-9.4.42-3.9.1.noarch",
          "openSUSE Leap 15.3:jetty-webapp-9.4.42-3.9.1.noarch",
          "openSUSE Leap 15.3:jetty-websocket-api-9.4.42-3.9.1.noarch",
          "openSUSE Leap 15.3:jetty-websocket-client-9.4.42-3.9.1.noarch",
          "openSUSE Leap 15.3:jetty-websocket-common-9.4.42-3.9.1.noarch",
          "openSUSE Leap 15.3:jetty-websocket-javadoc-9.4.42-3.9.1.noarch",
          "openSUSE Leap 15.3:jetty-websocket-server-9.4.42-3.9.1.noarch",
          "openSUSE Leap 15.3:jetty-websocket-servlet-9.4.42-3.9.1.noarch",
          "openSUSE Leap 15.3:jetty-xml-9.4.42-3.9.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2021-28164",
          "url": "https://www.suse.com/security/cve/CVE-2021-28164"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1184368 for CVE-2021-28164",
          "url": "https://bugzilla.suse.com/1184368"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1188438 for CVE-2021-28164",
          "url": "https://bugzilla.suse.com/1188438"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.3:jetty-annotations-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-client-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-continuation-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-http-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-io-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-jaas-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-javax-websocket-client-impl-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-javax-websocket-server-impl-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-jmx-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-jndi-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-jsp-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-minimal-javadoc-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-openid-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-plus-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-proxy-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-security-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-server-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-servlet-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-util-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-util-ajax-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-webapp-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-websocket-api-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-websocket-client-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-websocket-common-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-websocket-javadoc-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-websocket-server-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-websocket-servlet-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-xml-9.4.42-3.9.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.3:jetty-annotations-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-client-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-continuation-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-http-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-io-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-jaas-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-javax-websocket-client-impl-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-javax-websocket-server-impl-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-jmx-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-jndi-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-jsp-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-minimal-javadoc-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-openid-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-plus-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-proxy-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-security-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-server-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-servlet-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-util-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-util-ajax-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-webapp-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-websocket-api-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-websocket-client-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-websocket-common-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-websocket-javadoc-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-websocket-server-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-websocket-servlet-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-xml-9.4.42-3.9.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-07-11T08:05:38Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2021-28164"
    },
    {
      "cve": "CVE-2021-28165",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2021-28165"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invalid TLS frame.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.3:jetty-annotations-9.4.42-3.9.1.noarch",
          "openSUSE Leap 15.3:jetty-client-9.4.42-3.9.1.noarch",
          "openSUSE Leap 15.3:jetty-continuation-9.4.42-3.9.1.noarch",
          "openSUSE Leap 15.3:jetty-http-9.4.42-3.9.1.noarch",
          "openSUSE Leap 15.3:jetty-io-9.4.42-3.9.1.noarch",
          "openSUSE Leap 15.3:jetty-jaas-9.4.42-3.9.1.noarch",
          "openSUSE Leap 15.3:jetty-javax-websocket-client-impl-9.4.42-3.9.1.noarch",
          "openSUSE Leap 15.3:jetty-javax-websocket-server-impl-9.4.42-3.9.1.noarch",
          "openSUSE Leap 15.3:jetty-jmx-9.4.42-3.9.1.noarch",
          "openSUSE Leap 15.3:jetty-jndi-9.4.42-3.9.1.noarch",
          "openSUSE Leap 15.3:jetty-jsp-9.4.42-3.9.1.noarch",
          "openSUSE Leap 15.3:jetty-minimal-javadoc-9.4.42-3.9.1.noarch",
          "openSUSE Leap 15.3:jetty-openid-9.4.42-3.9.1.noarch",
          "openSUSE Leap 15.3:jetty-plus-9.4.42-3.9.1.noarch",
          "openSUSE Leap 15.3:jetty-proxy-9.4.42-3.9.1.noarch",
          "openSUSE Leap 15.3:jetty-security-9.4.42-3.9.1.noarch",
          "openSUSE Leap 15.3:jetty-server-9.4.42-3.9.1.noarch",
          "openSUSE Leap 15.3:jetty-servlet-9.4.42-3.9.1.noarch",
          "openSUSE Leap 15.3:jetty-util-9.4.42-3.9.1.noarch",
          "openSUSE Leap 15.3:jetty-util-ajax-9.4.42-3.9.1.noarch",
          "openSUSE Leap 15.3:jetty-webapp-9.4.42-3.9.1.noarch",
          "openSUSE Leap 15.3:jetty-websocket-api-9.4.42-3.9.1.noarch",
          "openSUSE Leap 15.3:jetty-websocket-client-9.4.42-3.9.1.noarch",
          "openSUSE Leap 15.3:jetty-websocket-common-9.4.42-3.9.1.noarch",
          "openSUSE Leap 15.3:jetty-websocket-javadoc-9.4.42-3.9.1.noarch",
          "openSUSE Leap 15.3:jetty-websocket-server-9.4.42-3.9.1.noarch",
          "openSUSE Leap 15.3:jetty-websocket-servlet-9.4.42-3.9.1.noarch",
          "openSUSE Leap 15.3:jetty-xml-9.4.42-3.9.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2021-28165",
          "url": "https://www.suse.com/security/cve/CVE-2021-28165"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1184367 for CVE-2021-28165",
          "url": "https://bugzilla.suse.com/1184367"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.3:jetty-annotations-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-client-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-continuation-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-http-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-io-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-jaas-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-javax-websocket-client-impl-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-javax-websocket-server-impl-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-jmx-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-jndi-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-jsp-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-minimal-javadoc-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-openid-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-plus-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-proxy-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-security-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-server-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-servlet-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-util-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-util-ajax-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-webapp-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-websocket-api-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-websocket-client-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-websocket-common-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-websocket-javadoc-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-websocket-server-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-websocket-servlet-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-xml-9.4.42-3.9.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.3:jetty-annotations-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-client-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-continuation-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-http-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-io-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-jaas-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-javax-websocket-client-impl-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-javax-websocket-server-impl-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-jmx-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-jndi-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-jsp-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-minimal-javadoc-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-openid-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-plus-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-proxy-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-security-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-server-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-servlet-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-util-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-util-ajax-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-webapp-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-websocket-api-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-websocket-client-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-websocket-common-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-websocket-javadoc-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-websocket-server-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-websocket-servlet-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-xml-9.4.42-3.9.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-07-11T08:05:38Z",
          "details": "important"
        }
      ],
      "title": "CVE-2021-28165"
    },
    {
      "cve": "CVE-2021-28169",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2021-28169"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "For Eclipse Jetty versions \u003c= 9.4.40, \u003c= 10.0.2, \u003c= 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory. For example a request to `/concat?/%2557EB-INF/web.xml` can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.3:jetty-annotations-9.4.42-3.9.1.noarch",
          "openSUSE Leap 15.3:jetty-client-9.4.42-3.9.1.noarch",
          "openSUSE Leap 15.3:jetty-continuation-9.4.42-3.9.1.noarch",
          "openSUSE Leap 15.3:jetty-http-9.4.42-3.9.1.noarch",
          "openSUSE Leap 15.3:jetty-io-9.4.42-3.9.1.noarch",
          "openSUSE Leap 15.3:jetty-jaas-9.4.42-3.9.1.noarch",
          "openSUSE Leap 15.3:jetty-javax-websocket-client-impl-9.4.42-3.9.1.noarch",
          "openSUSE Leap 15.3:jetty-javax-websocket-server-impl-9.4.42-3.9.1.noarch",
          "openSUSE Leap 15.3:jetty-jmx-9.4.42-3.9.1.noarch",
          "openSUSE Leap 15.3:jetty-jndi-9.4.42-3.9.1.noarch",
          "openSUSE Leap 15.3:jetty-jsp-9.4.42-3.9.1.noarch",
          "openSUSE Leap 15.3:jetty-minimal-javadoc-9.4.42-3.9.1.noarch",
          "openSUSE Leap 15.3:jetty-openid-9.4.42-3.9.1.noarch",
          "openSUSE Leap 15.3:jetty-plus-9.4.42-3.9.1.noarch",
          "openSUSE Leap 15.3:jetty-proxy-9.4.42-3.9.1.noarch",
          "openSUSE Leap 15.3:jetty-security-9.4.42-3.9.1.noarch",
          "openSUSE Leap 15.3:jetty-server-9.4.42-3.9.1.noarch",
          "openSUSE Leap 15.3:jetty-servlet-9.4.42-3.9.1.noarch",
          "openSUSE Leap 15.3:jetty-util-9.4.42-3.9.1.noarch",
          "openSUSE Leap 15.3:jetty-util-ajax-9.4.42-3.9.1.noarch",
          "openSUSE Leap 15.3:jetty-webapp-9.4.42-3.9.1.noarch",
          "openSUSE Leap 15.3:jetty-websocket-api-9.4.42-3.9.1.noarch",
          "openSUSE Leap 15.3:jetty-websocket-client-9.4.42-3.9.1.noarch",
          "openSUSE Leap 15.3:jetty-websocket-common-9.4.42-3.9.1.noarch",
          "openSUSE Leap 15.3:jetty-websocket-javadoc-9.4.42-3.9.1.noarch",
          "openSUSE Leap 15.3:jetty-websocket-server-9.4.42-3.9.1.noarch",
          "openSUSE Leap 15.3:jetty-websocket-servlet-9.4.42-3.9.1.noarch",
          "openSUSE Leap 15.3:jetty-xml-9.4.42-3.9.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2021-28169",
          "url": "https://www.suse.com/security/cve/CVE-2021-28169"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1187117 for CVE-2021-28169",
          "url": "https://bugzilla.suse.com/1187117"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.3:jetty-annotations-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-client-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-continuation-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-http-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-io-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-jaas-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-javax-websocket-client-impl-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-javax-websocket-server-impl-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-jmx-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-jndi-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-jsp-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-minimal-javadoc-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-openid-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-plus-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-proxy-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-security-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-server-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-servlet-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-util-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-util-ajax-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-webapp-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-websocket-api-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-websocket-client-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-websocket-common-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-websocket-javadoc-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-websocket-server-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-websocket-servlet-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-xml-9.4.42-3.9.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.3:jetty-annotations-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-client-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-continuation-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-http-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-io-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-jaas-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-javax-websocket-client-impl-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-javax-websocket-server-impl-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-jmx-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-jndi-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-jsp-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-minimal-javadoc-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-openid-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-plus-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-proxy-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-security-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-server-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-servlet-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-util-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-util-ajax-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-webapp-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-websocket-api-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-websocket-client-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-websocket-common-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-websocket-javadoc-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-websocket-server-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-websocket-servlet-9.4.42-3.9.1.noarch",
            "openSUSE Leap 15.3:jetty-xml-9.4.42-3.9.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-07-11T08:05:38Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2021-28169"
    }
  ]
}