CVE-2021-41079

Aliases:GHSA-59g9-7gfx-c72pBIT-tomcat-2021-41079
Advisory lineage Upstream: 0 Downstream: 17
Modified
Published: 16 Sept 2021, 14:40
Last modified:04 Aug 2024, 02:59

Vulnerability Summary

Overall Risk (default)
medium
30/100
CVSS Score
7.5 HIGH
v3.1 (nvd)
EPSS Score
0.1% LOW
0% probability +0.05%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

16 Sept 2021, 14:40
Published
Vulnerability first disclosed
04 Aug 2024, 02:59
Last Modified
Vulnerability information updated

Description

Apache Tomcat 8.5.0 to 8.5.63, 9.0.0-M1 to 9.0.43 and 10.0.0-M1 to 10.0.2 did not properly validate incoming TLS packets. When Tomcat was configured to use NIO+OpenSSL or NIO2+OpenSSL for TLS, a specially crafted packet could be used to trigger an infinite loop resulting in a denial of service.

CVSS Metrics

  • v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  • v2.0•MEDIUM•Score: 4.3AV:N/AC:M/Au:N/C:N/I:N/A:P

EPSS Trends

Current EPSS score: 0.10%• Percentile: 28%

Techniques & Countermeasures

  • CWE-835•Loop with Unreachable Exit Condition ('Infinite Loop')

    The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

  • CWE-20•Improper Input Validation

    The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Affected Systems

  • apache software foundation•apache tomcat

    Apache Tomcat 8.5 8.5.0 to 8.5.63 | Apache Tomcat 9 9.0.0-M1 to 9.0.43 | Apache Tomcat 10 10.0.0-M1 to 10.0.2

  • Unknown•Tomcat

    ≥ 8.5.0, < 8.5.64 | ≥ 9.0.0, < 9.0.44 | ≥ 10.0.0, ≤ 10.0.2

  • debian•debian_linux

    9.0 | 10.0 | 11.0

  • org.apache.tomcat•tomcat

    ≥ 10.0.0, < 10.0.4 | ≥ 9.0.0, < 9.0.44 | ≥ 8.5.0, < 8.5.64

  • netapp•management_services_for_element_software_and_netapp_hci

    na

References (12)