CVE:CVE-2021-28169
CNNVD:CNNVD-202106-724
Eclipse Jetty是Eclipse基金会的一个开源的、基于Java的Web服务器和Java Servlet容器。
Eclipse Jetty 中存在安全漏洞，该漏洞源于通过对ConcatServlet的双重编码路径请求访问WEB-INF目录中的受保护资源。以下产品及型号受到影响： Eclipse Jetty 9.4.40 版本及之前版本、Eclipse Jetty 10.0.2 版本及之前版本、Eclipse Jetty 11.0.2 版本及之前版本。
solution:Upgrade eclipse jetty to a higher version than 9.4.41,10.0.3,11.0.3,and avoid the version (,9.4.41),[10.0.0,10.0.3),[11.0.0,11.0.3); Upgrade debian debian_linux to a higher version than 9.0,10.0,and avoid the version 9.0,10.0; Upgrade oracle communications_cloud_native_core_policy to a higher version than 1.14.0,and avoid the version 1.14.0; Upgrade oracle rest_data_services to a higher version than 21.3,and avoid the version (,21.3); Upgrade netapp active_iq_unified_manager to a higher version than -; Upgrade netapp hci to a higher version than -; Upgrade netapp management_services_for_element_software to a higher version than -; Upgrade netapp snap_creator_framework to a higher version than -