Vulnerability · Published Mar 1, 2021 · Assigned by apache
CVE-2021-25329Incomplete fix for CVE-2020-9484
High 7.0
In plain English
A high-severity security flaw in Apache Tomcat from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 9.5% (higher than 95% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
The fix for CVE-2020-9484 was incomplete. When using Apache Tomcat 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41, 8.5.0 to 8.5.61 or 7.0.0. to 7.0.107 with a configuration edge case that was highly unlikely to be used, the Tomcat instance was still vulnerable to CVE-2020-9494. Note that both the previously published prerequisites for CVE-2020-9484 and the previously published mitigations for CVE-2020-9484 also apply to this issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | tomcat9 | 9.0.43-1 | DEBIAN-CVE-2021-25329 |
| Debian:13 | tomcat9 | 9.0.43-1 | DEBIAN-CVE-2021-25329 |
| Debian:14 | tomcat9 | 9.0.43-1 | DEBIAN-CVE-2021-25329 |
| Maven | org.apache.tomcat.embed:tomcat-embed-core | 10.0.2 | GHSA-jgwr-3qm3-26f3 |
| Maven | org.apache.tomcat.embed:tomcat-embed-core | 7.0.108 | GHSA-jgwr-3qm3-26f3 |
| Maven | org.apache.tomcat.embed:tomcat-embed-core | 9.0.41 | GHSA-jgwr-3qm3-26f3 |
| Maven | org.apache.tomcat.embed:tomcat-embed-core | 8.5.61 | GHSA-jgwr-3qm3-26f3 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Tomcat | Apache Tomcat 10 – before 10.0.0Apache Tomcat 9 – before 9.0.41Apache Tomcat 8.5 – before 8.5.61Apache Tomcat 7 – before 7.0.107 |
References
- https://lists.apache.org/thread.html/rfe62fbf9d4c314f166fe8c668e50e5d9dd882a99447f26f0367474bf%40%3Cannounce.tomcat.apache.org%3E x_refsource_MISC
- [tomcat-dev] 20210301 [SECURITY] CVE-2021-25329 Apache Tomcat Incomplete fix for CVE-2020-9484 (RCE via session persistence) mailing-list, x_refsource_MLIST
- [announce] 20210301 [SECURITY] CVE-2021-25329 Apache Tomcat Incomplete fix for CVE-2020-9484 (RCE via session persistence) mailing-list, x_refsource_MLIST
- [tomcat-users] 20210301 [SECURITY] CVE-2021-25329 Apache Tomcat Incomplete fix for CVE-2020-9484 (RCE via session persistence) mailing-list, x_refsource_MLIST
- [tomcat-dev] 20210301 svn commit: r1887027 - in /tomcat/site/trunk: docs/security-10.html docs/security-7.html docs/security-8.html docs/security-9.html xdocs/security-10.xml xdocs/security-7.xml xdocs/security-8.xml xdocs/security-9.xml mailing-list, x_refsource_MLIST
- [oss-security] 20210301 CVE-2021-25329: Apache Tomcat Incomplete fix for CVE-2020-9484 mailing-list, x_refsource_MLIST
- [debian-lts-announce] 20210316 [SECURITY] [DLA 2596-1] tomcat8 security update mailing-list, x_refsource_MLIST
- DSA-4891 vendor-advisory, x_refsource_DEBIAN
- [tomcat-users] 20210701 What is "h2c"? What is CVE-2021-25329? Re: Most recent security-related update to 8.5 mailing-list, x_refsource_MLIST
- [tomcat-users] 20210701 Re: What is "h2c"? What is CVE-2021-25329? Re: Most recent security-related update to 8.5 mailing-list, x_refsource_MLIST
- [tomcat-users] 20210702 Re: What is "h2c"? What is CVE-2021-25329? Re: Most recent security-related update to 8.5 mailing-list, x_refsource_MLIST
- [tomcat-users] 20210702 Re: CVE-2021-25329, was Re: Most recent security-related update to 8.5 mailing-list, x_refsource_MLIST
- https://www.oracle.com//security-alerts/cpujul2021.html x_refsource_MISC
- https://security.netapp.com/advisory/ntap-20210409-0002/ x_refsource_CONFIRM
- https://www.oracle.com/security-alerts/cpuoct2021.html x_refsource_MISC
- https://www.oracle.com/security-alerts/cpujan2022.html x_refsource_MISC
- GLSA-202208-34 vendor-advisory, x_refsource_GENTOO