tomcat: Infinite loop while reading an unexpected TLS packet when using OpenSSL JSSE engine

🗓️ 06 Oct 2021 13:38:02Reported by RedHatType

Tomcat vulnerability when using non blocking input output with OpenSSL for Transport Layer Security leads to an infinite loop and denial of service.

Reporter	Title	Published	Views	Family All 153
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Apache Tomcat affects App Connect Professional.	14 Dec 202111:38	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Apache Tomcat, Apache Commons FileUpload and Apache Axis might affect IBM Storage Copy Data Management	22 Mar 202416:05	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Rational Build Forge is affected by Apache Tomcat version used in it. (CVE-2021-41079)	7 Jul 202214:17	–	ibm
IBM Security Bulletins	Security Bulletin: IBM® Engineering Requirements Management DOORS/DWA vulnerabilities addressed in 9.7.2.8	18 Oct 202407:56	–	ibm
IBM Security Bulletins	Security Bulletin: IBM UrbanCode Build is affected by CVE-2021-41079	9 Feb 202216:25	–	ibm
IBM Security Bulletins	Security Bulletin: IBM UrbanCode Release is affected by CVE-2021-41079	25 Jan 202207:57	–	ibm
IBM Security Bulletins	Security Bulletin: Cloud Pak for Security contains packages that have multiple vulnerabilities	1 Apr 202216:38	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Spring, Tomcat, Jackson, sudo, and Linux kernel can affect IBM Spectrum Protect Plus	20 Mar 202418:36	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Data Risk Manager is affected by multiple vulnerabilities	11 Oct 202118:12	–	ibm
Tenable Nessus	Apache Tomcat < 10.0.4 Vulnerability	15 Sep 202100:00	–	nessus

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Enterprise Linux	7	noarch	jws5-tomcat	9.0.43-13.redhat_00013.1.el7jws	jws5-tomcat-9.0.43-13.redhat_00013.1.el7jws.noarch.rpm
Red Hat Enterprise Linux	8	noarch	jws5-tomcat	9.0.43-13.redhat_00013.1.el8jws	jws5-tomcat-9.0.43-13.redhat_00013.1.el8jws.noarch.rpm
Red Hat Enterprise Linux	7	noarch	jws5-tomcat-admin-webapps	9.0.43-13.redhat_00013.1.el7jws	jws5-tomcat-admin-webapps-9.0.43-13.redhat_00013.1.el7jws.noarch.rpm
Red Hat Enterprise Linux	8	noarch	jws5-tomcat-admin-webapps	9.0.43-13.redhat_00013.1.el8jws	jws5-tomcat-admin-webapps-9.0.43-13.redhat_00013.1.el8jws.noarch.rpm
Red Hat Enterprise Linux	7	noarch	jws5-tomcat-docs-webapp	9.0.43-13.redhat_00013.1.el7jws	jws5-tomcat-docs-webapp-9.0.43-13.redhat_00013.1.el7jws.noarch.rpm
Red Hat Enterprise Linux	8	noarch	jws5-tomcat-docs-webapp	9.0.43-13.redhat_00013.1.el8jws	jws5-tomcat-docs-webapp-9.0.43-13.redhat_00013.1.el8jws.noarch.rpm
Red Hat Enterprise Linux	7	noarch	jws5-tomcat-el-3.0-api	9.0.43-13.redhat_00013.1.el7jws	jws5-tomcat-el-3.0-api-9.0.43-13.redhat_00013.1.el7jws.noarch.rpm
Red Hat Enterprise Linux	8	noarch	jws5-tomcat-el-3.0-api	9.0.43-13.redhat_00013.1.el8jws	jws5-tomcat-el-3.0-api-9.0.43-13.redhat_00013.1.el8jws.noarch.rpm
Red Hat Enterprise Linux	7	noarch	jws5-tomcat-java-jdk11	9.0.43-13.redhat_00013.1.el7jws	jws5-tomcat-java-jdk11-9.0.43-13.redhat_00013.1.el7jws.noarch.rpm
Red Hat Enterprise Linux	7	noarch	jws5-tomcat-java-jdk8	9.0.43-13.redhat_00013.1.el7jws	jws5-tomcat-java-jdk8-9.0.43-13.redhat_00013.1.el7jws.noarch.rpm

Source	Link
access	www.access.redhat.com/security/cve/CVE-2021-41079
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
lists	www.lists.apache.org/thread.html/rccdef0349fdf4fb73a4e4403095446d7fe6264e0a58e2df5c6799434%40%3Cannounce.tomcat.apache.org%3E
nvd	www.nvd.nist.gov/vuln/detail/CVE-2021-41079
tomcat	www.tomcat.apache.org/security-10.html
tomcat	www.tomcat.apache.org/security-8.html
tomcat	www.tomcat.apache.org/security-9.html
cve	www.cve.org/CVERecord

04 Aug 2026 21:36Current

7.1High risk

Vulners AI Score7.1

CVSS 24.3

CVSS 3.17.5

EPSS0.07182

CWE-400