Vulnerability · Published Mar 1, 2021 · Assigned by apache

CVE-2021-25329Incomplete fix for CVE-2020-9484

High 7.0

In plain English

A high-severity security flaw in Apache Tomcat from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 9.5% (higher than 95% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)7.0High

Exploit odds (30 days)9.5%top 4.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The fix for CVE-2020-9484 was incomplete. When using Apache Tomcat 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41, 8.5.0 to 8.5.61 or 7.0.0. to 7.0.107 with a configuration edge case that was highly unlikely to be used, the Tomcat instance was still vulnerable to CVE-2020-9494. Note that both the previously published prerequisites for CVE-2020-9484 and the previously published mitigations for CVE-2020-9484 also apply to this issue.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	tomcat9	9.0.43-1	DEBIAN-CVE-2021-25329
Debian:13	tomcat9	9.0.43-1	DEBIAN-CVE-2021-25329
Debian:14	tomcat9	9.0.43-1	DEBIAN-CVE-2021-25329
Maven	org.apache.tomcat.embed:tomcat-embed-core	10.0.2	GHSA-jgwr-3qm3-26f3
Maven	org.apache.tomcat.embed:tomcat-embed-core	7.0.108	GHSA-jgwr-3qm3-26f3
Maven	org.apache.tomcat.embed:tomcat-embed-core	9.0.41	GHSA-jgwr-3qm3-26f3
Maven	org.apache.tomcat.embed:tomcat-embed-core	8.5.61	GHSA-jgwr-3qm3-26f3

Affected products (as reported)

Vendor	Product	Versions
Apache Software Foundation	Apache Tomcat	Apache Tomcat 10 – before 10.0.0Apache Tomcat 9 – before 9.0.41Apache Tomcat 8.5 – before 8.5.61Apache Tomcat 7 – before 7.0.107

References

https://lists.apache.org/thread.html/rfe62fbf9d4c314f166fe8c668e50e5d9dd882a99447f26f0367474bf%40%3Cannounce.tomcat.apache.org%3E x_refsource_MISC
[tomcat-dev] 20210301 [SECURITY] CVE-2021-25329 Apache Tomcat Incomplete fix for CVE-2020-9484 (RCE via session persistence) mailing-list, x_refsource_MLIST
[announce] 20210301 [SECURITY] CVE-2021-25329 Apache Tomcat Incomplete fix for CVE-2020-9484 (RCE via session persistence) mailing-list, x_refsource_MLIST
[tomcat-users] 20210301 [SECURITY] CVE-2021-25329 Apache Tomcat Incomplete fix for CVE-2020-9484 (RCE via session persistence) mailing-list, x_refsource_MLIST
[tomcat-dev] 20210301 svn commit: r1887027 - in /tomcat/site/trunk: docs/security-10.html docs/security-7.html docs/security-8.html docs/security-9.html xdocs/security-10.xml xdocs/security-7.xml xdocs/security-8.xml xdocs/security-9.xml mailing-list, x_refsource_MLIST
[oss-security] 20210301 CVE-2021-25329: Apache Tomcat Incomplete fix for CVE-2020-9484 mailing-list, x_refsource_MLIST
[debian-lts-announce] 20210316 [SECURITY] [DLA 2596-1] tomcat8 security update mailing-list, x_refsource_MLIST
DSA-4891 vendor-advisory, x_refsource_DEBIAN
[tomcat-users] 20210701 What is "h2c"? What is CVE-2021-25329? Re: Most recent security-related update to 8.5 mailing-list, x_refsource_MLIST
[tomcat-users] 20210701 Re: What is "h2c"? What is CVE-2021-25329? Re: Most recent security-related update to 8.5 mailing-list, x_refsource_MLIST
[tomcat-users] 20210702 Re: What is "h2c"? What is CVE-2021-25329? Re: Most recent security-related update to 8.5 mailing-list, x_refsource_MLIST
[tomcat-users] 20210702 Re: CVE-2021-25329, was Re: Most recent security-related update to 8.5 mailing-list, x_refsource_MLIST
https://www.oracle.com//security-alerts/cpujul2021.html x_refsource_MISC
https://security.netapp.com/advisory/ntap-20210409-0002/ x_refsource_CONFIRM
https://www.oracle.com/security-alerts/cpuoct2021.html x_refsource_MISC
https://www.oracle.com/security-alerts/cpujan2022.html x_refsource_MISC
GLSA-202208-34 vendor-advisory, x_refsource_GENTOO