{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Low" }, "category": "csaf_vex", "csaf_version": "2.0", "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "title": "OpenId Revoked authentication allows one request", "tracking": { "current_release_date": "2026-07-25T11:28:20+00:00", "generator": { "date": "2026-07-25T11:28:20+00:00", "engine": { "name": "CSAF Generator", "version": "3.1.0" } }, "id": "CVE-2023-41900", "initial_release_date": "2023-09-14T00:00:00+00:00", "revision_history": [ { "date": "2026-07-25T11:28:20+00:00", "number": "1", "summary": "Last generated version" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "category": "vendor", "name": "Red Hat", "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux 7-els", "product": { "name": "Red Hat Enterprise Linux 7-els", "product_id": "rhel-7-els.els", "product_identification_helper": { "cpe": "cpe:/o:redhat:rhel_els:7" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux 8.10.z", "product": { "name": "Red Hat Enterprise Linux 8.10.z", "product_id": "rhel-8", "product_identification_helper": { "cpe": "cpe:/a:redhat:enterprise_linux:8" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux 9.9", "product": { "name": "Red Hat Enterprise Linux 9.9", "product_id": "rhel-9", "product_identification_helper": { "cpe": "cpe:/a:redhat:enterprise_linux:9" } } }, { "category": "product_version", "name": "jetty", "product": { "name": "jetty", "product_id": "jetty", "product_identification_helper": { "purl": "pkg:rpm/redhat/jetty" } } }, { "category": "product_version", "name": "jetty-annotations", "product": { "name": "jetty-annotations", "product_id": "jetty-annotations", "product_identification_helper": { "purl": "pkg:rpm/redhat/jetty-annotations" } } }, { "category": "product_version", "name": "jetty-ant", "product": { "name": "jetty-ant", "product_id": "jetty-ant", "product_identification_helper": { "purl": "pkg:rpm/redhat/jetty-ant" } } }, { "category": "product_version", "name": "jetty-client", "product": { "name": "jetty-client", "product_id": "jetty-client", "product_identification_helper": { "purl": "pkg:rpm/redhat/jetty-client" } } }, { "category": "product_version", "name": "jetty-continuation", "product": { "name": "jetty-continuation", "product_id": "jetty-continuation", "product_identification_helper": { "purl": "pkg:rpm/redhat/jetty-continuation" } } }, { "category": "product_version", "name": "jetty-deploy", "product": { "name": "jetty-deploy", "product_id": "jetty-deploy", "product_identification_helper": { "purl": "pkg:rpm/redhat/jetty-deploy" } } }, { "category": "product_version", "name": "jetty-http", "product": { "name": "jetty-http", "product_id": "jetty-http", "product_identification_helper": { "purl": "pkg:rpm/redhat/jetty-http" } } }, { "category": "product_version", "name": "jetty-io", "product": { "name": "jetty-io", "product_id": "jetty-io", "product_identification_helper": { "purl": "pkg:rpm/redhat/jetty-io" } } }, { "category": "product_version", "name": "jetty-jaas", "product": { "name": "jetty-jaas", "product_id": "jetty-jaas", "product_identification_helper": { "purl": "pkg:rpm/redhat/jetty-jaas" } } }, { "category": "product_version", "name": "jetty-jaspi", "product": { "name": "jetty-jaspi", "product_id": "jetty-jaspi", "product_identification_helper": { "purl": "pkg:rpm/redhat/jetty-jaspi" } } }, { "category": "product_version", "name": "jetty-javadoc", "product": { "name": "jetty-javadoc", "product_id": "jetty-javadoc", "product_identification_helper": { "purl": "pkg:rpm/redhat/jetty-javadoc" } } }, { "category": "product_version", "name": "jetty-jmx", "product": { "name": "jetty-jmx", "product_id": "jetty-jmx", "product_identification_helper": { "purl": "pkg:rpm/redhat/jetty-jmx" } } }, { "category": "product_version", "name": "jetty-jndi", "product": { "name": "jetty-jndi", "product_id": "jetty-jndi", "product_identification_helper": { "purl": "pkg:rpm/redhat/jetty-jndi" } } }, { "category": "product_version", "name": "jetty-jsp", "product": { "name": "jetty-jsp", "product_id": "jetty-jsp", "product_identification_helper": { "purl": "pkg:rpm/redhat/jetty-jsp" } } }, { "category": "product_version", "name": "jetty-jspc-maven-plugin", "product": { "name": "jetty-jspc-maven-plugin", "product_id": "jetty-jspc-maven-plugin", "product_identification_helper": { "purl": "pkg:rpm/redhat/jetty-jspc-maven-plugin" } } }, { "category": "product_version", "name": "jetty-maven-plugin", "product": { "name": "jetty-maven-plugin", "product_id": "jetty-maven-plugin", "product_identification_helper": { "purl": "pkg:rpm/redhat/jetty-maven-plugin" } } }, { "category": "product_version", "name": "jetty-monitor", "product": { "name": "jetty-monitor", "product_id": "jetty-monitor", "product_identification_helper": { "purl": "pkg:rpm/redhat/jetty-monitor" } } }, { "category": "product_version", "name": "jetty-plus", "product": { "name": "jetty-plus", "product_id": "jetty-plus", "product_identification_helper": { "purl": "pkg:rpm/redhat/jetty-plus" } } }, { "category": "product_version", "name": "jetty-project", "product": { "name": "jetty-project", "product_id": "jetty-project", "product_identification_helper": { "purl": "pkg:rpm/redhat/jetty-project" } } }, { "category": "product_version", "name": "jetty-proxy", "product": { "name": "jetty-proxy", "product_id": "jetty-proxy", "product_identification_helper": { "purl": "pkg:rpm/redhat/jetty-proxy" } } }, { "category": "product_version", "name": "jetty-rewrite", "product": { "name": "jetty-rewrite", "product_id": "jetty-rewrite", "product_identification_helper": { "purl": "pkg:rpm/redhat/jetty-rewrite" } } }, { "category": "product_version", "name": "jetty-runner", "product": { "name": "jetty-runner", "product_id": "jetty-runner", "product_identification_helper": { "purl": "pkg:rpm/redhat/jetty-runner" } } }, { "category": "product_version", "name": "jetty-security", "product": { "name": "jetty-security", "product_id": "jetty-security", "product_identification_helper": { "purl": "pkg:rpm/redhat/jetty-security" } } }, { "category": "product_version", "name": "jetty-server", "product": { "name": "jetty-server", "product_id": "jetty-server", "product_identification_helper": { "purl": "pkg:rpm/redhat/jetty-server" } } }, { "category": "product_version", "name": "jetty-servlet", "product": { "name": "jetty-servlet", "product_id": "jetty-servlet", "product_identification_helper": { "purl": "pkg:rpm/redhat/jetty-servlet" } } }, { "category": "product_version", "name": "jetty-servlets", "product": { "name": "jetty-servlets", "product_id": "jetty-servlets", "product_identification_helper": { "purl": "pkg:rpm/redhat/jetty-servlets" } } }, { "category": "product_version", "name": "jetty-start", "product": { "name": "jetty-start", "product_id": "jetty-start", "product_identification_helper": { "purl": "pkg:rpm/redhat/jetty-start" } } }, { "category": "product_version", "name": "jetty-util", "product": { "name": "jetty-util", "product_id": "jetty-util", "product_identification_helper": { "purl": "pkg:rpm/redhat/jetty-util" } } }, { "category": "product_version", "name": "jetty-util-ajax", "product": { "name": "jetty-util-ajax", "product_id": "jetty-util-ajax", "product_identification_helper": { "purl": "pkg:rpm/redhat/jetty-util-ajax" } } }, { "category": "product_version", "name": "jetty-webapp", "product": { "name": "jetty-webapp", "product_id": "jetty-webapp", "product_identification_helper": { "purl": "pkg:rpm/redhat/jetty-webapp" } } }, { "category": "product_version", "name": "jetty-websocket-api", "product": { "name": "jetty-websocket-api", "product_id": "jetty-websocket-api", "product_identification_helper": { "purl": "pkg:rpm/redhat/jetty-websocket-api" } } }, { "category": "product_version", "name": "jetty-websocket-client", "product": { "name": "jetty-websocket-client", "product_id": "jetty-websocket-client", "product_identification_helper": { "purl": "pkg:rpm/redhat/jetty-websocket-client" } } }, { "category": "product_version", "name": "jetty-websocket-common", "product": { "name": "jetty-websocket-common", "product_id": "jetty-websocket-common", "product_identification_helper": { "purl": "pkg:rpm/redhat/jetty-websocket-common" } } }, { "category": "product_version", "name": "jetty-websocket-parent", "product": { "name": "jetty-websocket-parent", "product_id": "jetty-websocket-parent", "product_identification_helper": { "purl": "pkg:rpm/redhat/jetty-websocket-parent" } } }, { "category": "product_version", "name": "jetty-websocket-server", "product": { "name": "jetty-websocket-server", "product_id": "jetty-websocket-server", "product_identification_helper": { "purl": "pkg:rpm/redhat/jetty-websocket-server" } } }, { "category": "product_version", "name": "jetty-websocket-servlet", "product": { "name": "jetty-websocket-servlet", "product_id": "jetty-websocket-servlet", "product_identification_helper": { "purl": "pkg:rpm/redhat/jetty-websocket-servlet" } } }, { "category": "product_version", "name": "jetty-xml", "product": { "name": "jetty-xml", "product_id": "jetty-xml", "product_identification_helper": { "purl": "pkg:rpm/redhat/jetty-xml" } } }, { "category": "product_version", "name": "jetty", "product": { "name": "jetty", "product_id": "jetty.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jetty?arch=src" } } } ] } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "jetty as a component of Red Hat Enterprise Linux 7-els", "product_id": "rhel-7-els.els:jetty" }, "product_reference": "jetty", "relates_to_product_reference": "rhel-7-els.els" }, { "category": "default_component_of", "full_product_name": { "name": "jetty-annotations as a component of Red Hat Enterprise Linux 7-els", "product_id": "rhel-7-els.els:jetty-annotations" }, "product_reference": "jetty-annotations", "relates_to_product_reference": "rhel-7-els.els" }, { "category": "default_component_of", "full_product_name": { "name": "jetty-ant as a component of Red Hat Enterprise Linux 7-els", "product_id": "rhel-7-els.els:jetty-ant" }, "product_reference": "jetty-ant", "relates_to_product_reference": "rhel-7-els.els" }, { "category": "default_component_of", "full_product_name": { "name": "jetty-client as a component of Red Hat Enterprise Linux 7-els", "product_id": "rhel-7-els.els:jetty-client" }, "product_reference": "jetty-client", "relates_to_product_reference": "rhel-7-els.els" }, { "category": "default_component_of", "full_product_name": { "name": "jetty-continuation as a component of Red Hat Enterprise Linux 8.10.z", "product_id": "rhel-8:jetty-continuation" }, "product_reference": "jetty-continuation", "relates_to_product_reference": "rhel-8" }, { "category": "default_component_of", "full_product_name": { "name": "jetty-continuation as a component of Red Hat Enterprise Linux 7-els", "product_id": "rhel-7-els.els:jetty-continuation" }, "product_reference": "jetty-continuation", "relates_to_product_reference": "rhel-7-els.els" }, { "category": "default_component_of", "full_product_name": { "name": "jetty-deploy as a component of Red Hat Enterprise Linux 7-els", "product_id": "rhel-7-els.els:jetty-deploy" }, "product_reference": "jetty-deploy", "relates_to_product_reference": "rhel-7-els.els" }, { "category": "default_component_of", "full_product_name": { "name": "jetty-http as a component of Red Hat Enterprise Linux 8.10.z", "product_id": "rhel-8:jetty-http" }, "product_reference": "jetty-http", "relates_to_product_reference": "rhel-8" }, { "category": "default_component_of", "full_product_name": { "name": "jetty-http as a component of Red Hat Enterprise Linux 7-els", "product_id": "rhel-7-els.els:jetty-http" }, "product_reference": "jetty-http", "relates_to_product_reference": "rhel-7-els.els" }, { "category": "default_component_of", "full_product_name": { "name": "jetty-io as a component of Red Hat Enterprise Linux 8.10.z", "product_id": "rhel-8:jetty-io" }, "product_reference": "jetty-io", "relates_to_product_reference": "rhel-8" }, { "category": "default_component_of", "full_product_name": { "name": "jetty-io as a component of Red Hat Enterprise Linux 7-els", "product_id": "rhel-7-els.els:jetty-io" }, "product_reference": "jetty-io", "relates_to_product_reference": "rhel-7-els.els" }, { "category": "default_component_of", "full_product_name": { "name": "jetty-jaas as a component of Red Hat Enterprise Linux 7-els", "product_id": "rhel-7-els.els:jetty-jaas" }, "product_reference": "jetty-jaas", "relates_to_product_reference": "rhel-7-els.els" }, { "category": "default_component_of", "full_product_name": { "name": "jetty-jaspi as a component of Red Hat Enterprise Linux 7-els", "product_id": "rhel-7-els.els:jetty-jaspi" }, "product_reference": "jetty-jaspi", "relates_to_product_reference": "rhel-7-els.els" }, { "category": "default_component_of", "full_product_name": { "name": "jetty-javadoc as a component of Red Hat Enterprise Linux 7-els", "product_id": "rhel-7-els.els:jetty-javadoc" }, "product_reference": "jetty-javadoc", "relates_to_product_reference": "rhel-7-els.els" }, { "category": "default_component_of", "full_product_name": { "name": "jetty-jmx as a component of Red Hat Enterprise Linux 7-els", "product_id": "rhel-7-els.els:jetty-jmx" }, "product_reference": "jetty-jmx", "relates_to_product_reference": "rhel-7-els.els" }, { "category": "default_component_of", "full_product_name": { "name": "jetty-jndi as a component of Red Hat Enterprise Linux 7-els", "product_id": "rhel-7-els.els:jetty-jndi" }, "product_reference": "jetty-jndi", "relates_to_product_reference": "rhel-7-els.els" }, { "category": "default_component_of", "full_product_name": { "name": "jetty-jsp as a component of Red Hat Enterprise Linux 7-els", "product_id": "rhel-7-els.els:jetty-jsp" }, "product_reference": "jetty-jsp", "relates_to_product_reference": "rhel-7-els.els" }, { "category": "default_component_of", "full_product_name": { "name": "jetty-jspc-maven-plugin as a component of Red Hat Enterprise Linux 7-els", "product_id": "rhel-7-els.els:jetty-jspc-maven-plugin" }, "product_reference": "jetty-jspc-maven-plugin", "relates_to_product_reference": "rhel-7-els.els" }, { "category": "default_component_of", "full_product_name": { "name": "jetty-maven-plugin as a component of Red Hat Enterprise Linux 7-els", "product_id": "rhel-7-els.els:jetty-maven-plugin" }, "product_reference": "jetty-maven-plugin", "relates_to_product_reference": "rhel-7-els.els" }, { "category": "default_component_of", "full_product_name": { "name": "jetty-monitor as a component of Red Hat Enterprise Linux 7-els", "product_id": "rhel-7-els.els:jetty-monitor" }, "product_reference": "jetty-monitor", "relates_to_product_reference": "rhel-7-els.els" }, { "category": "default_component_of", "full_product_name": { "name": "jetty-plus as a component of Red Hat Enterprise Linux 7-els", "product_id": "rhel-7-els.els:jetty-plus" }, "product_reference": "jetty-plus", "relates_to_product_reference": "rhel-7-els.els" }, { "category": "default_component_of", "full_product_name": { "name": "jetty-project as a component of Red Hat Enterprise Linux 7-els", "product_id": "rhel-7-els.els:jetty-project" }, "product_reference": "jetty-project", "relates_to_product_reference": "rhel-7-els.els" }, { "category": "default_component_of", "full_product_name": { "name": "jetty-proxy as a component of Red Hat Enterprise Linux 7-els", "product_id": "rhel-7-els.els:jetty-proxy" }, "product_reference": "jetty-proxy", "relates_to_product_reference": "rhel-7-els.els" }, { "category": "default_component_of", "full_product_name": { "name": "jetty-rewrite as a component of Red Hat Enterprise Linux 7-els", "product_id": "rhel-7-els.els:jetty-rewrite" }, "product_reference": "jetty-rewrite", "relates_to_product_reference": "rhel-7-els.els" }, { "category": "default_component_of", "full_product_name": { "name": "jetty-runner as a component of Red Hat Enterprise Linux 7-els", "product_id": "rhel-7-els.els:jetty-runner" }, "product_reference": "jetty-runner", "relates_to_product_reference": "rhel-7-els.els" }, { "category": "default_component_of", "full_product_name": { "name": "jetty-security as a component of Red Hat Enterprise Linux 7-els", "product_id": "rhel-7-els.els:jetty-security" }, "product_reference": "jetty-security", "relates_to_product_reference": "rhel-7-els.els" }, { "category": "default_component_of", "full_product_name": { "name": "jetty-security as a component of Red Hat Enterprise Linux 8.10.z", "product_id": "rhel-8:jetty-security" }, "product_reference": "jetty-security", "relates_to_product_reference": "rhel-8" }, { "category": "default_component_of", "full_product_name": { "name": "jetty-server as a component of Red Hat Enterprise Linux 7-els", "product_id": "rhel-7-els.els:jetty-server" }, "product_reference": "jetty-server", "relates_to_product_reference": "rhel-7-els.els" }, { "category": "default_component_of", "full_product_name": { "name": "jetty-server as a component of Red Hat Enterprise Linux 8.10.z", "product_id": "rhel-8:jetty-server" }, "product_reference": "jetty-server", "relates_to_product_reference": "rhel-8" }, { "category": "default_component_of", "full_product_name": { "name": "jetty-servlet as a component of Red Hat Enterprise Linux 8.10.z", "product_id": "rhel-8:jetty-servlet" }, "product_reference": "jetty-servlet", "relates_to_product_reference": "rhel-8" }, { "category": "default_component_of", "full_product_name": { "name": "jetty-servlet as a component of Red Hat Enterprise Linux 7-els", "product_id": "rhel-7-els.els:jetty-servlet" }, "product_reference": "jetty-servlet", "relates_to_product_reference": "rhel-7-els.els" }, { "category": "default_component_of", "full_product_name": { "name": "jetty-servlets as a component of Red Hat Enterprise Linux 7-els", "product_id": "rhel-7-els.els:jetty-servlets" }, "product_reference": "jetty-servlets", "relates_to_product_reference": "rhel-7-els.els" }, { "category": "default_component_of", "full_product_name": { "name": "jetty-start as a component of Red Hat Enterprise Linux 7-els", "product_id": "rhel-7-els.els:jetty-start" }, "product_reference": "jetty-start", "relates_to_product_reference": "rhel-7-els.els" }, { "category": "default_component_of", "full_product_name": { "name": "jetty-util as a component of Red Hat Enterprise Linux 8.10.z", "product_id": "rhel-8:jetty-util" }, "product_reference": "jetty-util", "relates_to_product_reference": "rhel-8" }, { "category": "default_component_of", "full_product_name": { "name": "jetty-util as a component of Red Hat Enterprise Linux 7-els", "product_id": "rhel-7-els.els:jetty-util" }, "product_reference": "jetty-util", "relates_to_product_reference": "rhel-7-els.els" }, { "category": "default_component_of", "full_product_name": { "name": "jetty-util-ajax as a component of Red Hat Enterprise Linux 7-els", "product_id": "rhel-7-els.els:jetty-util-ajax" }, "product_reference": "jetty-util-ajax", "relates_to_product_reference": "rhel-7-els.els" }, { "category": "default_component_of", "full_product_name": { "name": "jetty-webapp as a component of Red Hat Enterprise Linux 7-els", "product_id": "rhel-7-els.els:jetty-webapp" }, "product_reference": "jetty-webapp", "relates_to_product_reference": "rhel-7-els.els" }, { "category": "default_component_of", "full_product_name": { "name": "jetty-websocket-api as a component of Red Hat Enterprise Linux 7-els", "product_id": "rhel-7-els.els:jetty-websocket-api" }, "product_reference": "jetty-websocket-api", "relates_to_product_reference": "rhel-7-els.els" }, { "category": "default_component_of", "full_product_name": { "name": "jetty-websocket-client as a component of Red Hat Enterprise Linux 7-els", "product_id": "rhel-7-els.els:jetty-websocket-client" }, "product_reference": "jetty-websocket-client", "relates_to_product_reference": "rhel-7-els.els" }, { "category": "default_component_of", "full_product_name": { "name": "jetty-websocket-common as a component of Red Hat Enterprise Linux 7-els", "product_id": "rhel-7-els.els:jetty-websocket-common" }, "product_reference": "jetty-websocket-common", "relates_to_product_reference": "rhel-7-els.els" }, { "category": "default_component_of", "full_product_name": { "name": "jetty-websocket-parent as a component of Red Hat Enterprise Linux 7-els", "product_id": "rhel-7-els.els:jetty-websocket-parent" }, "product_reference": "jetty-websocket-parent", "relates_to_product_reference": "rhel-7-els.els" }, { "category": "default_component_of", "full_product_name": { "name": "jetty-websocket-server as a component of Red Hat Enterprise Linux 7-els", "product_id": "rhel-7-els.els:jetty-websocket-server" }, "product_reference": "jetty-websocket-server", "relates_to_product_reference": "rhel-7-els.els" }, { "category": "default_component_of", "full_product_name": { "name": "jetty-websocket-servlet as a component of Red Hat Enterprise Linux 7-els", "product_id": "rhel-7-els.els:jetty-websocket-servlet" }, "product_reference": "jetty-websocket-servlet", "relates_to_product_reference": "rhel-7-els.els" }, { "category": "default_component_of", "full_product_name": { "name": "jetty-xml as a component of Red Hat Enterprise Linux 7-els", "product_id": "rhel-7-els.els:jetty-xml" }, "product_reference": "jetty-xml", "relates_to_product_reference": "rhel-7-els.els" }, { "category": "default_component_of", "full_product_name": { "name": "jetty.src as a component of Red Hat Enterprise Linux 8.10.z", "product_id": "rhel-8:jetty.src" }, "product_reference": "jetty.src", "relates_to_product_reference": "rhel-8" }, { "category": "default_component_of", "full_product_name": { "name": "jetty.src as a component of Red Hat Enterprise Linux 7-els", "product_id": "rhel-7-els.els:jetty.src" }, "product_reference": "jetty.src", "relates_to_product_reference": "rhel-7-els.els" }, { "category": "default_component_of", "full_product_name": { "name": "jetty.src as a component of Red Hat Enterprise Linux 9.9", "product_id": "rhel-9:jetty.src" }, "product_reference": "jetty.src", "relates_to_product_reference": "rhel-9" } ] }, "vulnerabilities": [ { "cve": "CVE-2023-41900", "cwe": { "id": "CWE-1390", "name": "Weak Authentication" }, "discovery_date": "2023-09-19T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "rhel-7-els.els:jetty-javadoc" ] } ], "notes": [ { "category": "description", "text": "Jetty is a Java based web server and servlet engine. Versions 9.4.21 through 9.4.51, 10.0.15, and 11.0.15 are vulnerable to weak authentication. If a Jetty `OpenIdAuthenticator` uses the optional nested `LoginService`, and that `LoginService` decides to revoke an already authenticated user, then the current request will still treat the user as authenticated. The authentication is then cleared from the session and subsequent requests will not be treated as authenticated. So a request on a previously authenticated session could be allowed to bypass authentication after it had been rejected by the `LoginService`. This impacts usages of the jetty-openid which have configured a nested `LoginService` and where that `LoginService` will is capable of rejecting previously authenticated users. Versions 9.4.52, 10.0.16, and 11.0.16 have a patch for this issue.", "title": "Vulnerability description" } ], "product_status": { "known_affected": [ "rhel-7-els.els:jetty", "rhel-7-els.els:jetty-annotations", "rhel-7-els.els:jetty-ant", "rhel-7-els.els:jetty-client", "rhel-7-els.els:jetty-continuation", "rhel-7-els.els:jetty-deploy", "rhel-7-els.els:jetty-http", "rhel-7-els.els:jetty-io", "rhel-7-els.els:jetty-jaas", "rhel-7-els.els:jetty-jaspi", "rhel-7-els.els:jetty-jmx", "rhel-7-els.els:jetty-jndi", "rhel-7-els.els:jetty-jsp", "rhel-7-els.els:jetty-jspc-maven-plugin", "rhel-7-els.els:jetty-maven-plugin", "rhel-7-els.els:jetty-monitor", "rhel-7-els.els:jetty-plus", "rhel-7-els.els:jetty-project", "rhel-7-els.els:jetty-proxy", "rhel-7-els.els:jetty-rewrite", "rhel-7-els.els:jetty-runner", "rhel-7-els.els:jetty-security", "rhel-7-els.els:jetty-server", "rhel-7-els.els:jetty-servlet", "rhel-7-els.els:jetty-servlets", "rhel-7-els.els:jetty-start", "rhel-7-els.els:jetty-util", "rhel-7-els.els:jetty-util-ajax", "rhel-7-els.els:jetty-webapp", "rhel-7-els.els:jetty-websocket-api", "rhel-7-els.els:jetty-websocket-client", "rhel-7-els.els:jetty-websocket-common", "rhel-7-els.els:jetty-websocket-parent", "rhel-7-els.els:jetty-websocket-server", "rhel-7-els.els:jetty-websocket-servlet", "rhel-7-els.els:jetty-xml", "rhel-7-els.els:jetty.src", "rhel-8:jetty-continuation", "rhel-8:jetty-http", "rhel-8:jetty-io", "rhel-8:jetty-security", "rhel-8:jetty-server", "rhel-8:jetty-servlet", "rhel-8:jetty-util", "rhel-8:jetty.src", "rhel-9:jetty.src" ], "known_not_affected": [ "rhel-7-els.els:jetty-javadoc" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-41900" }, { "category": "external", "summary": "nvd.nist.gov", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-41900" }, { "category": "external", "summary": "www.cve.org", "url": "https://www.cve.org/CVERecord?id=CVE-2023-41900" } ], "remediations": [ { "category": "no_fix_planned", "details": "Out of support scope", "product_ids": [ "rhel-7-els.els:jetty", "rhel-7-els.els:jetty-annotations", "rhel-7-els.els:jetty-ant", "rhel-7-els.els:jetty-client", "rhel-7-els.els:jetty-continuation", "rhel-7-els.els:jetty-deploy", "rhel-7-els.els:jetty-http", "rhel-7-els.els:jetty-io", "rhel-7-els.els:jetty-jaas", "rhel-7-els.els:jetty-jaspi", "rhel-7-els.els:jetty-jmx", "rhel-7-els.els:jetty-jndi", "rhel-7-els.els:jetty-jsp", "rhel-7-els.els:jetty-jspc-maven-plugin", "rhel-7-els.els:jetty-maven-plugin", "rhel-7-els.els:jetty-monitor", "rhel-7-els.els:jetty-plus", "rhel-7-els.els:jetty-project", "rhel-7-els.els:jetty-proxy", "rhel-7-els.els:jetty-rewrite", "rhel-7-els.els:jetty-runner", "rhel-7-els.els:jetty-security", "rhel-7-els.els:jetty-server", "rhel-7-els.els:jetty-servlet", "rhel-7-els.els:jetty-servlets", "rhel-7-els.els:jetty-start", "rhel-7-els.els:jetty-util", "rhel-7-els.els:jetty-util-ajax", "rhel-7-els.els:jetty-webapp", "rhel-7-els.els:jetty-websocket-api", "rhel-7-els.els:jetty-websocket-client", "rhel-7-els.els:jetty-websocket-common", "rhel-7-els.els:jetty-websocket-parent", "rhel-7-els.els:jetty-websocket-server", "rhel-7-els.els:jetty-websocket-servlet", "rhel-7-els.els:jetty-xml", "rhel-7-els.els:jetty.src" ] }, { "category": "no_fix_planned", "details": "Will not fix", "product_ids": [ "rhel-8:jetty-continuation", "rhel-8:jetty-http", "rhel-8:jetty-io", "rhel-8:jetty-security", "rhel-8:jetty-server", "rhel-8:jetty-servlet", "rhel-8:jetty-util", "rhel-8:jetty.src", "rhel-9:jetty.src" ] } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N", "baseScore": 3.5, "baseSeverity": "LOW" }, "products": [ "rhel-7-els.els:jetty", "rhel-7-els.els:jetty-annotations", "rhel-7-els.els:jetty-ant", "rhel-7-els.els:jetty-client", "rhel-7-els.els:jetty-continuation", "rhel-7-els.els:jetty-deploy", "rhel-7-els.els:jetty-http", "rhel-7-els.els:jetty-io", "rhel-7-els.els:jetty-jaas", "rhel-7-els.els:jetty-jaspi", "rhel-7-els.els:jetty-javadoc", "rhel-7-els.els:jetty-jmx", "rhel-7-els.els:jetty-jndi", "rhel-7-els.els:jetty-jsp", "rhel-7-els.els:jetty-jspc-maven-plugin", "rhel-7-els.els:jetty-maven-plugin", "rhel-7-els.els:jetty-monitor", "rhel-7-els.els:jetty-plus", "rhel-7-els.els:jetty-project", "rhel-7-els.els:jetty-proxy", "rhel-7-els.els:jetty-rewrite", "rhel-7-els.els:jetty-runner", "rhel-7-els.els:jetty-security", "rhel-7-els.els:jetty-server", "rhel-7-els.els:jetty-servlet", "rhel-7-els.els:jetty-servlets", "rhel-7-els.els:jetty-start", "rhel-7-els.els:jetty-util", "rhel-7-els.els:jetty-util-ajax", "rhel-7-els.els:jetty-webapp", "rhel-7-els.els:jetty-websocket-api", "rhel-7-els.els:jetty-websocket-client", "rhel-7-els.els:jetty-websocket-common", "rhel-7-els.els:jetty-websocket-parent", "rhel-7-els.els:jetty-websocket-server", "rhel-7-els.els:jetty-websocket-servlet", "rhel-7-els.els:jetty-xml", "rhel-7-els.els:jetty.src", "rhel-8:jetty-continuation", "rhel-8:jetty-http", "rhel-8:jetty-io", "rhel-8:jetty-security", "rhel-8:jetty-server", "rhel-8:jetty-servlet", "rhel-8:jetty-util", "rhel-8:jetty.src", "rhel-9:jetty.src" ] } ], "threats": [ { "category": "impact", "details": "Low", "product_ids": [ "rhel-7-els.els:jetty", "rhel-7-els.els:jetty-annotations", "rhel-7-els.els:jetty-ant", "rhel-7-els.els:jetty-client", "rhel-7-els.els:jetty-continuation", "rhel-7-els.els:jetty-deploy", "rhel-7-els.els:jetty-http", "rhel-7-els.els:jetty-io", "rhel-7-els.els:jetty-jaas", "rhel-7-els.els:jetty-jaspi", "rhel-7-els.els:jetty-javadoc", "rhel-7-els.els:jetty-jmx", "rhel-7-els.els:jetty-jndi", "rhel-7-els.els:jetty-jsp", "rhel-7-els.els:jetty-jspc-maven-plugin", "rhel-7-els.els:jetty-maven-plugin", "rhel-7-els.els:jetty-monitor", "rhel-7-els.els:jetty-plus", "rhel-7-els.els:jetty-project", "rhel-7-els.els:jetty-proxy", "rhel-7-els.els:jetty-rewrite", "rhel-7-els.els:jetty-runner", "rhel-7-els.els:jetty-security", "rhel-7-els.els:jetty-server", "rhel-7-els.els:jetty-servlet", "rhel-7-els.els:jetty-servlets", "rhel-7-els.els:jetty-start", "rhel-7-els.els:jetty-util", "rhel-7-els.els:jetty-util-ajax", "rhel-7-els.els:jetty-webapp", "rhel-7-els.els:jetty-websocket-api", "rhel-7-els.els:jetty-websocket-client", "rhel-7-els.els:jetty-websocket-common", "rhel-7-els.els:jetty-websocket-parent", "rhel-7-els.els:jetty-websocket-server", "rhel-7-els.els:jetty-websocket-servlet", "rhel-7-els.els:jetty-xml", "rhel-7-els.els:jetty.src", "rhel-8:jetty-continuation", "rhel-8:jetty-http", "rhel-8:jetty-io", "rhel-8:jetty-security", "rhel-8:jetty-server", "rhel-8:jetty-servlet", "rhel-8:jetty-util", "rhel-8:jetty.src", "rhel-9:jetty.src" ] } ], "title": "OpenId Revoked authentication allows one request" } ] }