CVE-2021-34428: Debian Linux
Low severity, CVSS 3.5. EPSS: 1% chance of exploitation in the next 30 days.
For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, if an exception is thrown from the SessionListener#sessionDestroyed() method, then the session ID is not invalidated in the session ID manager. On deployments with clustered sessions and multiple contexts this can result in a session not being invalidated. This can result in an application used on a shared computer being left logged in.
Affected products
- Debian Debian Linux: version 10.0 only
- Eclipse Jetty: up to and including 9.4.40; from 10.0.0, up to and including 10.0.2; from 11.0.0, up to and including 11.0.2
- Netapp Active Iq Unified Manager: affected versions not specified
- Netapp E-Series Santricity OS Controller: from 11.0, up to and including 11.70.1
- Netapp E-Series Santricity Web Services: affected versions not specified
- Netapp Element Plug-In For vCenter Server: affected versions not specified
- Netapp Santricity Cloud Connector: affected versions not specified
- Netapp Snap Creator Framework: affected versions not specified
- Netapp Snapmanager: affected versions not specified
- Oracle Autovue For Agile Product Lifecycle Management: version 21.0.2 only
- Oracle Communications Element Manager: version 8.2.2 only
- Oracle Communications Services Gatekeeper: version 7.0 only
- Oracle Communications Session Report Manager: from 8.0.0.0, up to and including 8.2.4.0
- Oracle Communications Session Route Manager: from 8.0.0, up to and including 8.2.4.0
- Oracle Rest Data Services: before 21.3 (fixed in 21.3)
- Oracle Siebel Core - Automation: up to and including 21.9
Published 2021-06-22. Last modified 2026-06-17.