CVE:CVE-2021-28163
CNNVD:CNNVD-202104-042
Eclipse Jetty是Eclipse基金会的一个开源的、基于Java的Web服务器和Java Servlet容器。
Eclipse Jetty 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to 11.0.1 存在后置链接漏洞，该漏洞源于如果用户使用的是一个符号链接的webapps目录，webapps目录的内容会被部署为一个静态的webapp，无意中服务于webapps本身和该目录下的其他任何东西。
solution:Upgrade eclipse jetty to a higher version than 9.4.39,10.0.0:beta2,10.0.1,11.0.0,11.0.0:beta2,11.0.0:beta3,11.0.1,and avoid the version [9.4.32,9.4.39),10.0.0:beta2,10.0.1,11.0.0,11.0.0:beta2,11.0.0:beta3,11.0.1; Upgrade fedoraproject fedora to a higher version than 32,33,34,and avoid the version 32,33,34; Upgrade apache ignite to a higher version than 2.1.1,and avoid the version (,2.1.1); Upgrade apache solr to a higher version than 8.8.1,and avoid the version 8.8.1; Upgrade netapp cloud_manager to a higher version than -; Upgrade netapp e-series_performance_analyzer to a higher version than -; Upgrade netapp e-series_santricity_os_controller to a higher version than 11.70.1,and avoid the version [11.0.0,11.70.1]; Upgrade netapp e-series_santricity_web_services to a higher version than -; Upgrade netapp element_plug-in_for_vcenter_server to a higher version than -; Upgrade netapp santricity_cloud_connector to a higher version than -; Upgrade netapp snapcenter to a higher version than -; Upgrade netapp snapcenter_plug-in to a higher version than -; netapp storage_replication_adapter_for_clustered_data_ontap avoid the version [9.6,); netapp vasa_provider_for_clustered_data_ontap avoid the version [9.6,); netapp virtual_storage_console avoid the version [9.6,); Upgrade oracle autovue_for_agile_product_lifecycle_management to a higher version than 21.0.2,and avoid the version 21.0.2; Upgrade oracle banking_apis to a higher version than 20.1,21.1,and avoid the version 20.1,21.1; Upgrade oracle banking_digital_experience to a higher version than 20.1,21.1,and avoid the version 20.1,21.1; Upgrade oracle communications_element_manager to a higher version than 8.2.2,and avoid the version 8.2.2; Upgrade oracle communications_services_gatekeeper to a higher version than 7.0,and avoid the version 7.0; Upgrade oracle communications_session_report_manager to a higher version than 8.2.4.0,and avoid the version [8.0.0,8.2.4.0]; Upgrade oracle communications_session_route_manager to a higher version than 8.2.4.0,and avoid the version [8.0.0,8.2.4.0]; Upgrade oracle siebel_core_-_automation to a higher version than 21.9,and avoid the version (,21.9]