En resumen
- CVE-2021-43980 es una vulnerabilidad BAJO (CVSS 3.7) que afecta a org.apache.tomcat:tomcat, tomcat (apache).
- Probabilidad de explotación en los próximos 30 días (EPSS): 2.4%, mayor que el 83.8% de las vulnerabilidades.
- Solución: actualizar a 10.0.20, 10.1.0-M14, 8.5.78, 9.0.62 o posterior.
| Package | Affected versions | Patched versions |
|---|
| org.apache.tomcat:tomcat Maven | ≥ 10.0.0-M1, < 10.0.20≥ 10.1.0-M1, < 10.1.0-M14≥ 8.5.0, < 8.5.78≥ 9.0.0-M1, < 9.0.62
| 10.0.2010.1.0-M148.5.789.0.62
|
| tomcat | = 10.1.0≥ 10.0.0, ≤ 10.0.18≥ 8.5.0, ≤ 8.5.77≥ 9.0.0, ≤ 9.0.60
| No fix yet |
Description
The simplified implementation of blocking reads and writes introduced in Tomcat 10 and back-ported to Tomcat 9.0.47 onwards exposed a long standing (but extremely hard to trigger) concurrency bug in Apache Tomcat 10.1.0 to 10.1.0-M12, 10.0.0-M1 to 10.0.18, 9.0.0-M1 to 9.0.60 and 8.5.0 to 8.5.77 that could cause client connections to share an Http11Processor instance resulting in responses, or part responses, to be received by the wrong client.
NVD description
The simplified implementation of blocking reads and writes introduced in Tomcat 10 and back-ported to Tomcat 9.0.47 onwards exposed a long standing (but extremely hard to trigger) concurrency bug in Apache Tomcat 10.1.0 to 10.1.0-M12, 10.0.0-M1 to 10.0.18, 9.0.0-M1 to 9.0.60 and 8.5.0 to 8.5.77 that could cause client connections to share an Http11Processor instance resulting in responses, or part responses, to be received by the wrong client.
Más vulnerabilidades de org.apache.tomcat:tomcat
Ver todo →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free