REDHAT-BUG-2456519: High severity Eclipse Jetty vulnerability
In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable.
Upon returning from the initial checks, there are conditions that cause an early return from the JASPIAuthenticator code without clearing those ThreadLocals.
A subsequent request using the same thread inherits the ThreadLocal values, leading to a broken access control and privilege escalation.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2456519?
The severity of REDHAT-BUG-2456519 is classified as moderate due to potential security risks associated with uninitialized ThreadLocal variables.
How do I fix REDHAT-BUG-2456519?
To fix REDHAT-BUG-2456519, update to the latest version of Eclipse Jetty where the issue has been resolved.
What are the potential risks of REDHAT-BUG-2456519?
The potential risks of REDHAT-BUG-2456519 include unauthorized access and security vulnerabilities due to improper handling of ThreadLocal variables.
Which versions of Eclipse Jetty are affected by REDHAT-BUG-2456519?
Specific versions of Eclipse Jetty are affected by REDHAT-BUG-2456519, so it's important to check the release notes for details.
Is there a workaround for REDHAT-BUG-2456519?
Currently, there is no known workaround for REDHAT-BUG-2456519; updating to a patched version is recommended.