VYPR
Get started
← All advisories
Moderate severityNVD Advisory· Published Feb 7, 2007· Updated Apr 23, 2026

CVE-2006-6969

CVE-2006-6969

Description

Jetty before 4.2.27, 5.1 before 5.1.12, 6.0 before 6.0.2, and 6.1 before 6.1.0pre3 generates predictable session identifiers using java.util.random, which makes it easier for remote attackers to guess a session identifier through brute force attacks, bypass authentication requirements, and possibly conduct cross-site request forgery attacks.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.eclipse.jetty:jetty-serverMaven
< 4.2.274.2.27
org.eclipse.jetty:jetty-serverMaven
>= 5.1.0, < 5.1.125.1.12
org.eclipse.jetty:jetty-serverMaven
>= 6.0.0, < 6.0.26.0.2
org.eclipse.jetty:jetty-serverMaven
>= 6.1.0pre1, < 6.1.0pre36.1.0pre3

Affected products

13
  • Jetty/Jetty HTTP Server13 versions
    cpe:2.3:a:jetty:jetty_http_server:4.2.11:*:*:*:*:*:*:*+ 12 more
    • cpe:2.3:a:jetty:jetty_http_server:4.2.11:*:*:*:*:*:*:*
    • cpe:2.3:a:jetty:jetty_http_server:4.2.12:*:*:*:*:*:*:*
    • cpe:2.3:a:jetty:jetty_http_server:4.2.14:*:*:*:*:*:*:*
    • cpe:2.3:a:jetty:jetty_http_server:4.2.15:*:*:*:*:*:*:*
    • cpe:2.3:a:jetty:jetty_http_server:4.2.16:*:*:*:*:*:*:*
    • cpe:2.3:a:jetty:jetty_http_server:4.2.17:*:*:*:*:*:*:*
    • cpe:2.3:a:jetty:jetty_http_server:4.2.18:*:*:*:*:*:*:*
    • cpe:2.3:a:jetty:jetty_http_server:4.2.19:*:*:*:*:*:*:*
    • cpe:2.3:a:jetty:jetty_http_server:4.2.24:*:*:*:*:*:*:*
    • cpe:2.3:a:jetty:jetty_http_server:4.2.9:*:*:*:*:*:*:*
    • cpe:2.3:a:jetty:jetty_http_server:5.1.11:*:*:*:*:*:*:*
    • cpe:2.3:a:jetty:jetty_http_server:6.0.1:*:*:*:*:*:*:*
    • cpe:2.3:a:jetty:jetty_http_server:6.1.0_pre2:*:*:*:*:*:*:*

Patches

2
b31f606bf805

Use SecureRandom for session ID generation

https://github.com/jetty-project/codehaus-jetty6gregwNov 22, 2006via ghsa
commit
4 files changed · +2547 −31
  • trunk/extras/cometd/src/main/java/org/mortbay/cometd/Bayeux.java+16 −5 modified
    @@ -15,6 +15,7 @@
 package org.mortbay.cometd;
 
 import java.io.IOException;
+import java.security.SecureRandom;
 import java.util.ArrayList;
 import java.util.HashMap;
 import java.util.Iterator;
@@ -54,7 +55,7 @@ public class Bayeux
     HashMap _clients=new HashMap();
     ServletContext _context;
     DateCache _dateCache=new DateCache();
-    Random _random=new Random(System.currentTimeMillis());
+    Random _random;
     HashMap _handlers=new HashMap();
     HashMap _transports=new HashMap();
     HashMap _filters=new java.util.HashMap();
@@ -80,6 +81,16 @@ public class Bayeux
     Bayeux(ServletContext context)
     {
         _context=context;
+        try 
+        {
+            _random=SecureRandom.getInstance("SHA1PRNG");
+        }
+        catch (Exception e)
+        {
+            context.log("Could not get secure random for ID generation",e);
+            _random=new Random();
+        }
+        _random.setSeed(_random.nextLong()^hashCode()^(context.hashCode()<<32)^Runtime.getRuntime().freeMemory());
     }
 
     /* ------------------------------------------------------------ */
@@ -248,9 +259,9 @@ void advise(Client client, Transport transport, Object advice) throws IOExceptio
     }
 
     /* ------------------------------------------------------------ */
-    long getRandom()
+    long getRandom(long variation)
     {
-        long l=_random.nextLong();
+        long l=_random.nextLong()^variation;
         return l<0?-l:l;
     }
 
@@ -465,9 +476,9 @@ public void handle(Client client, Transport transport, Map message)
             // select a random channel ID if none specifified
             if (channel_id==null)
             {
-                channel_id=Long.toString(getRandom(),36);
+                channel_id=Long.toString(getRandom(message.hashCode()^client.hashCode()),36);
                 while (getChannel(channel_id)!=null)
-                    channel_id=Long.toString(getRandom(),36);
+                    channel_id=Long.toString(getRandom(message.hashCode()^client.hashCode()),36);
             }
 
             // get the channel (or create if permitted)
  • trunk/extras/cometd/src/main/java/org/mortbay/cometd/Channel.java+2 −2 modified
    @@ -132,8 +132,8 @@ public void publish(Object data, Client from)
      */
     public String getToken(Client client, boolean subscribe, boolean send, boolean oneTime)
     {
-        String token=Long.toString(_bayeux.getRandom(),36);
-        // TODO register somewher
+        String token=Long.toString(_bayeux.getRandom(client.hashCode()),36);
+        // TODO register somewhere ?
         return token;
     }
  • trunk/modules/jetty/src/main/java/org/mortbay/jetty/servlet/HashSessionIdManager.java+54 −10 modified
    @@ -14,6 +14,8 @@
 
 package org.mortbay.jetty.servlet;
 
+import java.security.NoSuchAlgorithmException;
+import java.security.SecureRandom;
 import java.util.Random;
 
 import javax.servlet.http.HttpServletRequest;
@@ -22,6 +24,7 @@
 import org.mortbay.component.AbstractLifeCycle;
 import org.mortbay.jetty.SessionIdManager;
 import org.mortbay.jetty.servlet.AbstractSessionManager.Session;
+import org.mortbay.log.Log;
 import org.mortbay.util.MultiMap;
 
 /* ------------------------------------------------------------ */
@@ -30,10 +33,13 @@
  */
 public class HashSessionIdManager extends AbstractLifeCycle implements SessionIdManager
 {
-    private final static String __NEW_SESSION_ID="org.mortbay.jetty.newSessionId";
+    private final static String __NEW_SESSION_ID="org.mortbay.jetty.newSessionId";  
+    protected final static String SESSION_ID_RANDOM_ALGORITHM = "SHA1PRNG";
+    protected final static String SESSION_ID_RANDOM_ALGORITHM_ALT = "IBMSecureRandom";
 
     MultiMap _sessions;
     protected Random _random;
+    private boolean _weakRandom;
     private String _workerName;
 
     /* ------------------------------------------------------------ */
@@ -45,6 +51,7 @@ public HashSessionIdManager()
     public HashSessionIdManager(Random random)
     {
         _random=random;
+      
     }
 
     /* ------------------------------------------------------------ */
@@ -75,8 +82,27 @@ public void setWorkerName(String workerName)
     protected void doStart()
     {
         if (_random==null)
-            _random=new Random();
-        _random.nextLong();
+        {      
+            try 
+            {
+                _random=SecureRandom.getInstance(SESSION_ID_RANDOM_ALGORITHM);
+            }
+            catch (NoSuchAlgorithmException e)
+            {
+                try
+                {
+                    _random=SecureRandom.getInstance(SESSION_ID_RANDOM_ALGORITHM_ALT);
+                    _weakRandom=false;
+                }
+                catch (NoSuchAlgorithmException e_alt)
+                {
+                    Log.warn("Could not generate SecureRandom for session-id randomness",e);
+                    _random=new Random();
+                    _weakRandom=true;
+                }
+            }
+        }
+        _random.setSeed(_random.nextLong()^System.currentTimeMillis()^hashCode()^Runtime.getRuntime().freeMemory());
         _sessions=new MultiMap();
     }
 
@@ -145,11 +171,11 @@ public void invalidateAll(String id)
     /* ------------------------------------------------------------ */
     /*
      * new Session ID. If the request has a requestedSessionID which is unique,
-     * that is used. The session ID is created as a unique random long,
-     * represented as in a base between 30 and 36, selected by timestamp. If the
-     * request has a jvmRoute attribute, that is appended as a worker tag, else
-     * any worker tag set on the manager is appended. @param request @param
-     * created @return Session ID.
+     * that is used. The session ID is created as a unique random long XORed with
+     * connection specific information, base 36.
+     * @param request 
+     * @param created 
+     * @return Session ID.
      */
     public String newSessionId(HttpServletRequest request, long created)
     {
@@ -169,15 +195,33 @@ public String newSessionId(HttpServletRequest request, long created)
             String id=null;
             while (id==null||id.length()==0||idInUse(id))
             {
-                long r=_random.nextLong();
+                long r=_weakRandom
+                ?(hashCode()^Runtime.getRuntime().freeMemory()^_random.nextInt()^(((long)request.hashCode())<<32))
+                :_random.nextLong();
+                r^=created;
+                if (request!=null && request.getRemoteAddr()!=null)
+                    r^=request.getRemoteAddr().hashCode();
                 if (r<0)
                     r=-r;
-                id=Long.toString(r,30+(int)(created%7));
+                id=Long.toString(r,36);
             }
 
             request.setAttribute(__NEW_SESSION_ID,id);
             return id;
         }
     }
 
+    /* ------------------------------------------------------------ */
+    public Random getRandom()
+    {
+        return _random;
+    }
+
+    /* ------------------------------------------------------------ */
+    public void setRandom(Random random)
+    {
+        _random=random;
+        _weakRandom=false;
+    }
+
 }
\ No newline at end of file
  • trunk/VERSION.txt+2475 −14 modified
36f81d2e7058

Use SecureRandom for session ID generation

https://github.com/jetty-project/codehaus-jetty6gregwNov 22, 2006via ghsa
commit
4 files changed · +2547 −31
  • extras/cometd/src/main/java/org/mortbay/cometd/Bayeux.java+16 −5 modified
    @@ -15,6 +15,7 @@
 package org.mortbay.cometd;
 
 import java.io.IOException;
+import java.security.SecureRandom;
 import java.util.ArrayList;
 import java.util.HashMap;
 import java.util.Iterator;
@@ -54,7 +55,7 @@ public class Bayeux
     HashMap _clients=new HashMap();
     ServletContext _context;
     DateCache _dateCache=new DateCache();
-    Random _random=new Random(System.currentTimeMillis());
+    Random _random;
     HashMap _handlers=new HashMap();
     HashMap _transports=new HashMap();
     HashMap _filters=new java.util.HashMap();
@@ -80,6 +81,16 @@ public class Bayeux
     Bayeux(ServletContext context)
     {
         _context=context;
+        try 
+        {
+            _random=SecureRandom.getInstance("SHA1PRNG");
+        }
+        catch (Exception e)
+        {
+            context.log("Could not get secure random for ID generation",e);
+            _random=new Random();
+        }
+        _random.setSeed(_random.nextLong()^hashCode()^(context.hashCode()<<32)^Runtime.getRuntime().freeMemory());
     }
 
     /* ------------------------------------------------------------ */
@@ -248,9 +259,9 @@ void advise(Client client, Transport transport, Object advice) throws IOExceptio
     }
 
     /* ------------------------------------------------------------ */
-    long getRandom()
+    long getRandom(long variation)
     {
-        long l=_random.nextLong();
+        long l=_random.nextLong()^variation;
         return l<0?-l:l;
     }
 
@@ -465,9 +476,9 @@ public void handle(Client client, Transport transport, Map message)
             // select a random channel ID if none specifified
             if (channel_id==null)
             {
-                channel_id=Long.toString(getRandom(),36);
+                channel_id=Long.toString(getRandom(message.hashCode()^client.hashCode()),36);
                 while (getChannel(channel_id)!=null)
-                    channel_id=Long.toString(getRandom(),36);
+                    channel_id=Long.toString(getRandom(message.hashCode()^client.hashCode()),36);
             }
 
             // get the channel (or create if permitted)
  • extras/cometd/src/main/java/org/mortbay/cometd/Channel.java+2 −2 modified
    @@ -132,8 +132,8 @@ public void publish(Object data, Client from)
      */
     public String getToken(Client client, boolean subscribe, boolean send, boolean oneTime)
     {
-        String token=Long.toString(_bayeux.getRandom(),36);
-        // TODO register somewher
+        String token=Long.toString(_bayeux.getRandom(client.hashCode()),36);
+        // TODO register somewhere ?
         return token;
     }
  • modules/jetty/src/main/java/org/mortbay/jetty/servlet/HashSessionIdManager.java+54 −10 modified
    @@ -14,6 +14,8 @@
 
 package org.mortbay.jetty.servlet;
 
+import java.security.NoSuchAlgorithmException;
+import java.security.SecureRandom;
 import java.util.Random;
 
 import javax.servlet.http.HttpServletRequest;
@@ -22,6 +24,7 @@
 import org.mortbay.component.AbstractLifeCycle;
 import org.mortbay.jetty.SessionIdManager;
 import org.mortbay.jetty.servlet.AbstractSessionManager.Session;
+import org.mortbay.log.Log;
 import org.mortbay.util.MultiMap;
 
 /* ------------------------------------------------------------ */
@@ -30,10 +33,13 @@
  */
 public class HashSessionIdManager extends AbstractLifeCycle implements SessionIdManager
 {
-    private final static String __NEW_SESSION_ID="org.mortbay.jetty.newSessionId";
+    private final static String __NEW_SESSION_ID="org.mortbay.jetty.newSessionId";  
+    protected final static String SESSION_ID_RANDOM_ALGORITHM = "SHA1PRNG";
+    protected final static String SESSION_ID_RANDOM_ALGORITHM_ALT = "IBMSecureRandom";
 
     MultiMap _sessions;
     protected Random _random;
+    private boolean _weakRandom;
     private String _workerName;
 
     /* ------------------------------------------------------------ */
@@ -45,6 +51,7 @@ public HashSessionIdManager()
     public HashSessionIdManager(Random random)
     {
         _random=random;
+      
     }
 
     /* ------------------------------------------------------------ */
@@ -75,8 +82,27 @@ public void setWorkerName(String workerName)
     protected void doStart()
     {
         if (_random==null)
-            _random=new Random();
-        _random.nextLong();
+        {      
+            try 
+            {
+                _random=SecureRandom.getInstance(SESSION_ID_RANDOM_ALGORITHM);
+            }
+            catch (NoSuchAlgorithmException e)
+            {
+                try
+                {
+                    _random=SecureRandom.getInstance(SESSION_ID_RANDOM_ALGORITHM_ALT);
+                    _weakRandom=false;
+                }
+                catch (NoSuchAlgorithmException e_alt)
+                {
+                    Log.warn("Could not generate SecureRandom for session-id randomness",e);
+                    _random=new Random();
+                    _weakRandom=true;
+                }
+            }
+        }
+        _random.setSeed(_random.nextLong()^System.currentTimeMillis()^hashCode()^Runtime.getRuntime().freeMemory());
         _sessions=new MultiMap();
     }
 
@@ -145,11 +171,11 @@ public void invalidateAll(String id)
     /* ------------------------------------------------------------ */
     /*
      * new Session ID. If the request has a requestedSessionID which is unique,
-     * that is used. The session ID is created as a unique random long,
-     * represented as in a base between 30 and 36, selected by timestamp. If the
-     * request has a jvmRoute attribute, that is appended as a worker tag, else
-     * any worker tag set on the manager is appended. @param request @param
-     * created @return Session ID.
+     * that is used. The session ID is created as a unique random long XORed with
+     * connection specific information, base 36.
+     * @param request 
+     * @param created 
+     * @return Session ID.
      */
     public String newSessionId(HttpServletRequest request, long created)
     {
@@ -169,15 +195,33 @@ public String newSessionId(HttpServletRequest request, long created)
             String id=null;
             while (id==null||id.length()==0||idInUse(id))
             {
-                long r=_random.nextLong();
+                long r=_weakRandom
+                ?(hashCode()^Runtime.getRuntime().freeMemory()^_random.nextInt()^(((long)request.hashCode())<<32))
+                :_random.nextLong();
+                r^=created;
+                if (request!=null && request.getRemoteAddr()!=null)
+                    r^=request.getRemoteAddr().hashCode();
                 if (r<0)
                     r=-r;
-                id=Long.toString(r,30+(int)(created%7));
+                id=Long.toString(r,36);
             }
 
             request.setAttribute(__NEW_SESSION_ID,id);
             return id;
         }
     }
 
+    /* ------------------------------------------------------------ */
+    public Random getRandom()
+    {
+        return _random;
+    }
+
+    /* ------------------------------------------------------------ */
+    public void setRandom(Random random)
+    {
+        _random=random;
+        _weakRandom=false;
+    }
+
 }
\ No newline at end of file
  • VERSION.txt+2475 −14 modified

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

16

News mentions

0

No linked articles in our index yet.