CVE-2021-28169

Name	CVE-2021-28169
Description	For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory. For example a request to `/concat?/%2557EB-INF/web.xml` can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-2688-1, DSA-4949-1
Debian Bugs	989999

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
jetty9 (PTS)	bullseye (security), bullseye	9.4.50-4+deb11u2	fixed
	bookworm, bookworm (security)	9.4.50-4+deb12u3	fixed
	trixie, sid	9.4.56-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
jetty	source	(unstable)	(unfixed)
jetty8	source	(unstable)	(unfixed)
jetty9	source	stretch	9.2.30-0+deb9u2	DLA-2688-1
jetty9	source	buster	9.4.16-0+deb10u1	DSA-4949-1
jetty9	source	(unstable)	9.4.39-2		989999

Notes

https://github.com/eclipse/jetty.project/security/advisories/GHSA-gwcr-j4wh-j3cq
https://github.com/eclipse/jetty.project/issues/6263
https://github.com/eclipse/jetty.project/commit/1c05b0bcb181c759e98b060bded0b9376976b055 (v9.4.41)