CVE-2021-41079
16.09.2021, 15:15
Apache Tomcat 8.5.0 to 8.5.63, 9.0.0-M1 to 9.0.43 and 10.0.0-M1 to 10.0.2 did not properly validate incoming TLS packets. When Tomcat was configured to use NIO+OpenSSL or NIO2+OpenSSL for TLS, a specially crafted packet could be used to trigger an infinite loop resulting in a denial of service.
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| apache | tomcat | 8.5.0 ≤ 𝑥 < 8.5.64 |
| apache | tomcat | 9.0.0 ≤ 𝑥 < 9.0.44 |
| apache | tomcat | 10.0.0 ≤ 𝑥 ≤ 10.0.2 |
| debian | debian_linux | 9.0 |
| debian | debian_linux | 10.0 |
| debian | debian_linux | 11.0 |
| netapp | management_services_for_element_software_and_netapp_hci | - |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
Ubuntu Product | |||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| tomcat6 |
| ||||||||||||||||||||||
| tomcat7 |
| ||||||||||||||||||||||
| tomcat8 |
| ||||||||||||||||||||||
| tomcat9 |
|
openSUSE / SLES Releases
openSUSE Product | |||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| javapackages-tools |
| ||||||||||||||||||||||||||||||||||||||
| tomcat |
| ||||||||||||||||||||||||||||||||||||||
| tomcat-admin-webapps |
| ||||||||||||||||||||||||||||||||||||||
| tomcat-docs-webapp |
| ||||||||||||||||||||||||||||||||||||||
| tomcat-el-3_0-api |
| ||||||||||||||||||||||||||||||||||||||
| tomcat-javadoc |
| ||||||||||||||||||||||||||||||||||||||
| tomcat-jsp-2_3-api |
| ||||||||||||||||||||||||||||||||||||||
| tomcat-lib |
| ||||||||||||||||||||||||||||||||||||||
| tomcat-servlet-4_0-api |
| ||||||||||||||||||||||||||||||||||||||
| tomcat-webapps |
|
Common Weakness Enumeration
- CWE-20 - Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
- CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')The program contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
References