Vulnerability · Published Mar 1, 2021 · Assigned by apache
CVE-2021-25122Apache Tomcat h2c request mix-up
High 7.5
In plain English
A high-severity information exposure in Apache Tomcat from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 18.1% (higher than 97% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)7.5High
Exploit odds (30 days)18.1%top 2.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
When responding to new h2c connection requests, Apache Tomcat versions 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41 and 8.5.0 to 8.5.61 could duplicate request headers and a limited amount of request body from one request to another meaning user A and user B could both see the results of user A's request.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | tomcat9 | 9.0.43-1 | DEBIAN-CVE-2021-25122 |
| Debian:13 | tomcat9 | 9.0.43-1 | DEBIAN-CVE-2021-25122 |
| Debian:14 | tomcat9 | 9.0.43-1 | DEBIAN-CVE-2021-25122 |
| Maven | org.apache.tomcat.embed:tomcat-embed-core | 9.0.43 | GHSA-j39c-c8hj-x4j3 |
| Maven | org.apache.tomcat.embed:tomcat-embed-core | 8.5.63 | GHSA-j39c-c8hj-x4j3 |
| Maven | org.apache.tomcat.embed:tomcat-embed-core | 10.0.2 | GHSA-j39c-c8hj-x4j3 |
| Maven | org.apache.tomcat:tomcat-coyote | 10.0.2 | GHSA-j39c-c8hj-x4j3 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Tomcat | Apache Tomcat 10 – before 10.0.2Apache Tomcat 9 – before 9.0.42Apache Tomcat 8.5 – before 8.5.62 |
Weakness: CWE-200
References
- https://lists.apache.org/thread.html/r7b95bc248603360501f18c8eb03bb6001ec0ee3296205b34b07105b7%40%3Cannounce.tomcat.apache.org%3E x_refsource_MISC
- [tomcat-users] 20210301 [SECURITY] CVE-2021-25122 Apache Tomcat h2c request mix-up mailing-list, x_refsource_MLIST
- [tomcat-dev] 20210301 [SECURITY] CVE-2021-25122 Apache Tomcat h2c request mix-up mailing-list, x_refsource_MLIST
- [tomcat-dev] 20210301 svn commit: r1887027 - in /tomcat/site/trunk: docs/security-10.html docs/security-7.html docs/security-8.html docs/security-9.html xdocs/security-10.xml xdocs/security-7.xml xdocs/security-8.xml xdocs/security-9.xml mailing-list, x_refsource_MLIST
- [announce] 20210301 [SECURITY] CVE-2021-25122 Apache Tomcat h2c request mix-up mailing-list, x_refsource_MLIST
- [oss-security] 20210301 CVE-2021-25122: Apache Tomcat h2c request mix-up mailing-list, x_refsource_MLIST
- [tomcat-users] 20210305 RE: [SECURITY] CVE-2021-25122 Apache Tomcat h2c request mix-up mailing-list, x_refsource_MLIST
- [tomcat-users] 20210305 Re: [SECURITY] CVE-2021-25122 Apache Tomcat h2c request mix-up mailing-list, x_refsource_MLIST
- [debian-lts-announce] 20210316 [SECURITY] [DLA 2596-1] tomcat8 security update mailing-list, x_refsource_MLIST
- DSA-4891 vendor-advisory, x_refsource_DEBIAN
- https://www.oracle.com//security-alerts/cpujul2021.html x_refsource_MISC
- https://security.netapp.com/advisory/ntap-20210409-0002/ x_refsource_CONFIRM
- https://www.oracle.com/security-alerts/cpuoct2021.html x_refsource_MISC
- https://www.oracle.com/security-alerts/cpujan2022.html x_refsource_MISC
- GLSA-202208-34 vendor-advisory, x_refsource_GENTOO