CVE-2021-41079

Published on: 09/16/2021 12:00:00 AM UTC

Last Modified on: 10/15/2021 03:15:00 PM UTC

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Certain versions of Tomcat from Apache contain the following vulnerability:

Apache Tomcat 8.5.0 to 8.5.63, 9.0.0-M1 to 9.0.43 and 10.0.0-M1 to 10.0.2 did not properly validate incoming TLS packets. When Tomcat was configured to use NIO+OpenSSL or NIO2+OpenSSL for TLS, a specially crafted packet could be used to trigger an infinite loop resulting in a denial of service.

  • CVE-2021-41079 has been assigned by URL Logo [email protected] to track the vulnerability - currently rated as HIGH severity.
  • Affected Vendor/Software: URL Logo Apache Software Foundation - Apache Tomcat version = 8.5.0 to 8.5.63
  • Affected Vendor/Software: URL Logo Apache Software Foundation - Apache Tomcat version = 9.0.0-M1 to 9.0.43
  • Affected Vendor/Software: URL Logo Apache Software Foundation - Apache Tomcat version = 10.0.0-M1 to 10.0.2

CVSS3 Score: 7.5 - HIGH

Attack
Vector
Attack
Complexity
Privileges
Required
User
Interaction
NETWORK LOW NONE NONE
Scope Confidentiality
Impact
Integrity
Impact
Availability
Impact
UNCHANGED NONE NONE HIGH

CVSS2 Score: 4.3 - MEDIUM

Access
Vector
Access
Complexity
Authentication
NETWORK MEDIUM NONE
Confidentiality
Impact
Integrity
Impact
Availability
Impact
NONE NONE PARTIAL

CVE References

Description Tags Link
Pony Mail! lists.apache.org
text/html
URL Logo MISC lists.apache.org/thread.html/rccdef0349fdf4fb73a4e4403095446d7fe6264e0a58e2df5c6799434%40%3Cannounce.tomcat.apache.org%3E
[SECURITY] [DLA 2764-1] tomcat8 security update lists.debian.org
text/html
URL Logo MLIST [debian-lts-announce] 20210922 [SECURITY] [DLA 2764-1] tomcat8 security update
Debian -- Security Information -- DSA-4986-1 tomcat9 www.debian.org
Depreciated Link
text/html
URL Logo DEBIAN DSA-4986
Pony Mail! lists.apache.org
text/html
URL Logo MLIST [tomcat-users] 20211014 [SECURITY] CVE-2021-42340 Apache Tomcat DoS
Pony Mail! lists.apache.org
text/html
URL Logo MLIST [tomcat-dev] 20211014 [SECURITY] CVE-2021-42340 Apache Tomcat DoS
CVE-2021-41079 Apache Tomcat Vulnerability in NetApp Products | NetApp Product Security security.netapp.com
text/html
URL Logo CONFIRM security.netapp.com/advisory/ntap-20211008-0005/

Related QID Numbers

  • 150385 Apache Tomcat Denial of Service Vulnerability (CVE-2021-41079)
  • 178801 Debian Security Update for tomcat8 (DLA 2764-1)
  • 239732 Red Hat Update for red hat jboss web server 5.5.1 (RHSA-2021:3741)
  • 352859 Amazon Linux Security Advisory for tomcat8: ALAS-2021-1547
  • 751320 SUSE Enterprise Linux Security Update for tomcat (SUSE-SU-2021:3602-1)
  • 751355 OpenSUSE Security Update for tomcat (openSUSE-SU-2021:3672-1)
  • 751364 SUSE Enterprise Linux Security Update for tomcat (SUSE-SU-2021:3669-1)
  • 751365 SUSE Enterprise Linux Security Update for tomcat (SUSE-SU-2021:3670-1)
  • 751370 OpenSUSE Security Update for tomcat (openSUSE-SU-2021:1490-1)
  • 980413 Java (maven) Security Update for org.apache.tomcat:tomcat (GHSA-59g9-7gfx-c72p)

Known Affected Configurations (CPE V2.3)

Type Vendor Product Version Update Edition Language
ApplicationApacheTomcatAllAllAllAll
ApplicationApacheTomcatAllAllAllAll
Operating
System
DebianDebian Linux9.0AllAllAll
  • cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*:
  • cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*:
  • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*:

Discovery Credit

The Apache Tomcat security team would like to thank Thomas Wozenilek for originally reporting this issue and David Frankson of Infinite Campus for also providing a test case that reproduced the issue.

Social Mentions

Source Title Posted (UTC)
Twitter Icon @omokazuki SIOSセキュリティブログを更新しました。 Apache Tomcatの複数の脆弱性情報(Important: CVE-2021-41079) #sios_tech #security #vulnerability… twitter.com/i/web/status/1… 2021-09-15 20:32:44
Twitter Icon @fd0 Apache Tomcatの脆弱性情報(Important: CVE-2021-41079) - security.sios.com security.sios.com/vulnerability/… 2021-09-16 12:53:57
Twitter Icon @CVEreport CVE-2021-41079 : #Apache Tomcat 8.5.0 to 8.5.63, 9.0.0-M1 to 9.0.43 and 10.0.0-M1 to 10.0.2 did not properly valida… twitter.com/i/web/status/1… 2021-09-16 14:47:23
Twitter Icon @LinInfoSec Openssl - CVE-2021-41079: lists.apache.org/thread.html/rc… 2021-09-16 19:45:21
© CVE.report 2021 Twitter Nitter Twitter Viewer |

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

CVE.report and Source URL Uptime Status status.cve.report