GHSA-jg2x-r643-w2ch CVE-2006-6969
Jetty Uses Predictable Session Identifiers
- Severity
- Medium
- The publisher's own rating, not a CVSS score
- Exploit chance (EPSS)
- 1.61%
- Chance of exploitation in the next 30 days. Higher than 75.95% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-330 Use of Insufficiently Random Values
- Fix
4.2.27- Upgrade org.eclipse.jetty:jetty-server to this version or later
Description
Jetty before 4.2.27, 5.1 before 5.1.12, 6.0 before 6.0.2, and 6.1 before 6.1.0pre3 generates predictable session identifiers using java.util.random, which makes it easier for remote attackers to guess a session identifier through brute force attacks, bypass authentication requirements, and possibly conduct cross-site request forgery attacks.
Affected versions
Maven
| Package | Vulnerable | Fixed in |
|---|---|---|
| org.eclipse.jetty:jetty-server | < 4.2.27 |
4.2.27 |
| org.eclipse.jetty:jetty-server | >= 5.1.0, < 5.1.12 |
5.1.12 |
| org.eclipse.jetty:jetty-server | >= 6.0.0, < 6.0.2 |
6.0.2 |
| org.eclipse.jetty:jetty-server | >= 6.1.0pre1, < 6.1.0pre3 |
6.1.0pre3 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
org.eclipse.jetty:jetty-server Maven → 4.2.27
- maven
<dependency><groupId>org.eclipse.jetty</groupId><artifactId>jetty-server</artifactId><version>4.2.27</version></dependency>- gradle
implementation("org.eclipse.jetty:jetty-server:4.2.27")
Weakness
CWE-330: Use of Insufficiently Random Values
The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.
How to prevent it
- Architecture and Design: Use a well-vetted algorithm that is currently considered to be strong by experts in the field, and select well-tested implementations with adequate length seeds. In general, if a pseudo-random number generator is not advertised as being cryptographically secure, then it is probably a statistical PRNG and should not be used in security-sensitive contexts. Pseudo-random number generators can produce predictable numbers if the generator is known and the seed can be guessed. A 256-bit seed is a good starting point for producing a "random enough" number.
- Implementation: Consider a PRNG that re-seeds itself as needed from high quality pseudo-random output sources, such as hardware devices.
- Architecture and Design, Requirements: Use products or modules that conform to FIPS 140-2 [REF-267] to avoid obvious entropy problems. Consult FIPS 140-2 Annex C ("Approved Random Number Generators").
References
Advisories
Packages
Other links
- github.com/jetty-project/codehaus-jetty6/commit/36f81d2e7058b012f6718bc2f1e2786…
- github.com/jetty-project/codehaus-jetty6/commit/b31f606bf8058a38ab6253aa8dc2dfe…
- exchange.xforce.ibmcloud.com/vulnerabilities/32240
- web.archive.org/web/20070208112816/http://fisheye.codehaus.org/changelog/jetty
- web.archive.org/web/20070602184857/http://archives.neohapsis.com/archives/bugtraq/20…
- web.archive.org/web/20121019131825/http://www.securityfocus.com/archive/1/459164/100…
- web.archive.org/web/20200228100052/http://www.securityfocus.com/bid/22405
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-7p3p-8qv8-m2vh Eclipse Jetty: HTTP Authority/Host mismatch | Medium | Also affects org.eclipse.jetty:jetty-server |
| GHSA-f4v5-65jj-pcr2 Eclipse Jetty: Cross-Request Leakage for trailers on HTTP/1.1 keep-alive connections | High | Also affects org.eclipse.jetty:jetty-server |
| GHSA-9299-c6m4-mjhc Eclipse Jetty: DoS attack triggering OutOfMemory with 100-Continue requests | High | Also affects org.eclipse.jetty:jetty-server |
| GHSA-xxh7-fcf3-rj7f The Eclipse Jetty Server Artifact has a Gzip request memory leak | High | Also affects org.eclipse.jetty:jetty-server |
| GHSA-q4rv-gq96-w7c5 **UNSUPPORTED WHEN ASSIGNED** GzipHandler causes part of request body to be seen as request body of a separate request | High | Also affects org.eclipse.jetty:jetty-server |
| GHSA-g8m5-722r-8whq Eclipse Jetty's ThreadLimitHandler.getRemote() vulnerable to remote DoS attacks | Medium | Also affects org.eclipse.jetty:jetty-server |
| GHSA-p26g-97m4-6q7c Eclipse Jetty's cookie parsing of quoted values can exfiltrate values from other cookies | Medium | Also affects org.eclipse.jetty:jetty-server |
| GHSA-qw69-rqj8-6qw8 OutOfMemoryError for large multipart without filename in Eclipse Jetty | Medium | Also affects org.eclipse.jetty:jetty-server |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor