Vulnerability · Published Sep 16, 2021 · Assigned by apache
CVE-2021-41079Apache Tomcat DoS with unexpected TLS packet
High 7.5
In plain English
A high-severity improper input validation in Apache Tomcat from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 7.2% (higher than 94% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)7.5High
Exploit odds (30 days)7.2%top 5.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Apache Tomcat 8.5.0 to 8.5.63, 9.0.0-M1 to 9.0.43 and 10.0.0-M1 to 10.0.2 did not properly validate incoming TLS packets. When Tomcat was configured to use NIO+OpenSSL or NIO2+OpenSSL for TLS, a specially crafted packet could be used to trigger an infinite loop resulting in a denial of service.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | tomcat9 | 9.0.53-1 | DEBIAN-CVE-2021-41079 |
| Debian:13 | tomcat9 | 9.0.53-1 | DEBIAN-CVE-2021-41079 |
| Debian:14 | tomcat9 | 9.0.53-1 | DEBIAN-CVE-2021-41079 |
| Maven | org.apache.tomcat:tomcat | 10.0.4 | GHSA-59g9-7gfx-c72p |
| Maven | org.apache.tomcat:tomcat | 9.0.44 | GHSA-59g9-7gfx-c72p |
| Maven | org.apache.tomcat:tomcat | 8.5.64 | GHSA-59g9-7gfx-c72p |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Tomcat | Apache Tomcat 8.5 8.5.0 to 8.5.63Apache Tomcat 9 9.0.0-M1 to 9.0.43Apache Tomcat 10 10.0.0-M1 to 10.0.2 |
Weakness: CWE-20
References
- https://lists.apache.org/thread.html/rccdef0349fdf4fb73a4e4403095446d7fe6264e0a58e2df5c6799434%40%3Cannounce.tomcat.apache.org%3E x_refsource_MISC
- [debian-lts-announce] 20210922 [SECURITY] [DLA 2764-1] tomcat8 security update mailing-list, x_refsource_MLIST
- https://security.netapp.com/advisory/ntap-20211008-0005/ x_refsource_CONFIRM
- [tomcat-dev] 20211014 [SECURITY] CVE-2021-42340 Apache Tomcat DoS mailing-list, x_refsource_MLIST
- [tomcat-users] 20211014 [SECURITY] CVE-2021-42340 Apache Tomcat DoS mailing-list, x_refsource_MLIST
- DSA-4986 vendor-advisory, x_refsource_DEBIAN