| Package | Affected versions | Patched versions |
|---|---|---|
| org.eclipse.jetty.ee10:jetty-ee10-jaspi | ≥ 12.0.0, < 12.0.34≥ 12.1.0, < 12.1.8 | 12.0.3412.1.8 |
| org.eclipse.jetty.ee11:jetty-ee11-jaspi | ≥ 12.0.0, < 12.0.34≥ 12.1.0, < 12.1.8 | 12.0.3412.1.8 |
| org.eclipse.jetty.ee8:jetty-ee8-jaspi | ≥ 12.0.0, < 12.0.34≥ 12.1.0, < 12.1.8 | 12.0.3412.1.8 |
| org.eclipse.jetty.ee9:jetty-ee9-jaspi | ≥ 12.0.0, < 12.0.34≥ 12.1.0, < 12.1.8 | 12.0.3412.1.8 |
| org.eclipse.jetty:jetty-jaspi | ≥ 10.0.0, < 10.0.29≥ 11.0.0, < 11.0.29≥ 9.4.0, < 9.4.61 | 10.0.2911.0.299.4.61 |
| jetty | ≥ 10.0.0, ≤ 10.0.26≥ 11.0.0, ≤ 11.0.26≥ 12.0.0, < 12.0.34≥ 12.1.0, < 12.1.8≥ 9.4.0, ≤ 9.4.58 | 12.0.3412.1.8 |
A security vulnerability has been identified in Jetty's JaspiAuthenticator.java.
The root cause is a failure to consistently clear authentication metadata stored in ThreadLocal during certain error or incomplete authentication flows.
Specifically, after a GroupPrincipalCallback is persisted into the ThreadLocal, the authentication process may exit prematurely — before the ThreadLocal storage is cleared — if a mandatory CallerPrincipalCallback is missing or an exception occurs.
This allows a subsequent, unprivileged user processed by the same worker thread to inherit these residual security roles, leading to Broken Access Control and Privilege Escalation.
See also attached PDF.
An unauthenticated user may gain ungrated privileges from a previous request (privilege escalation).
No patches yet.
Do not use Jetty's JASPI.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free