Insecure generation of random numbers In org.eclipse.jetty:jetty-server
Description
Jetty Uses Predictable Session Identifiers Jetty before 4.2.27, 5.1 before 5.1.12, 6.0 before 6.0.2, and 6.1 before 6.1.0pre3 generates predictable session identifiers using java.util.random, which makes it easier for remote attackers to guess a session identifier through brute force attacks, bypass authentication requirements, and possibly conduct cross-site request forgery attacks.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 maven | 4.2.27, 5.1.12, 6.0.2, 6.1.0pre3 |
Aliases
1. 2. 3. 4.
References
1. 2. 3. 4. 5. 6. 7.