En bref
- CVE-2021-43980 est une vulnérabilité FAIBLE (CVSS 3.7) touchant org.apache.tomcat:tomcat, tomcat (apache).
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 2.4%, plus élevée que 83.8% des vulnérabilités.
- Correctif : mettre à jour vers 10.0.20, 10.1.0-M14, 8.5.78, 9.0.62 ou plus récent.
| Package | Affected versions | Patched versions |
|---|
| org.apache.tomcat:tomcat Maven | ≥ 10.0.0-M1, < 10.0.20≥ 10.1.0-M1, < 10.1.0-M14≥ 8.5.0, < 8.5.78≥ 9.0.0-M1, < 9.0.62
| 10.0.2010.1.0-M148.5.789.0.62
|
| tomcat | = 10.1.0≥ 10.0.0, ≤ 10.0.18≥ 8.5.0, ≤ 8.5.77≥ 9.0.0, ≤ 9.0.60
| No fix yet |
Description
The simplified implementation of blocking reads and writes introduced in Tomcat 10 and back-ported to Tomcat 9.0.47 onwards exposed a long standing (but extremely hard to trigger) concurrency bug in Apache Tomcat 10.1.0 to 10.1.0-M12, 10.0.0-M1 to 10.0.18, 9.0.0-M1 to 9.0.60 and 8.5.0 to 8.5.77 that could cause client connections to share an Http11Processor instance resulting in responses, or part responses, to be received by the wrong client.
NVD description
The simplified implementation of blocking reads and writes introduced in Tomcat 10 and back-ported to Tomcat 9.0.47 onwards exposed a long standing (but extremely hard to trigger) concurrency bug in Apache Tomcat 10.1.0 to 10.1.0-M12, 10.0.0-M1 to 10.0.18, 9.0.0-M1 to 9.0.60 and 8.5.0 to 8.5.77 that could cause client connections to share an Http11Processor instance resulting in responses, or part responses, to be received by the wrong client.
Autres vulnérabilités de org.apache.tomcat:tomcat
Tout voir →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free