KLA12291 DoS vulnerability in Apache Tomcat

A denial of service vulnerability was found in Apache Tomcat. Malicious users can exploit this vulnerability to cause denial of service. Original advisories Apache Tomcat 8.5.x vulnerabilities Apache Tomcat 9.x vulnerabilities Apache Tomcat 10.0.x vulnerabilities Related products Apache-Tomcat CV...

PT-2021-7027

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 8.5.0 through 8.5.63 Apache Tomcat versions 9.0.0-M1 through 9.0.43 Apache Tomcat versions 10.0.0-M1 through 10.0.2 Description The issue arises from insufficient validation of incoming TLS packets. When configured to us...

Fixed in Apache Tomcat 9.0.44

Important: Denial of Service CVE-2021-41079 When Tomcat was configured to use NIO+OpenSSL or NIO2+OpenSSL for TLS, a specially crafted packet could be used to trigger an infinite loop resulting in a denial of service. This was fixed with commit d4b340fa. This issue was first reported to the Apach...

Fixed in Apache Tomcat 10.0.4

Note: The issue below was fixed in Apache Tomcat 10.0.3 but the release vote for the 10.0.3 release candidate did not pass. Therefore, although users must download 10.0.4 to obtain a version that includes a fix for these issues, version 10.0.3 is not included in the list of affected versions...

Fixed in Apache Tomcat 8.5.64

Important: Denial of Service CVE-2021-41079 When Tomcat was configured to use NIO+OpenSSL or NIO2+OpenSSL for TLS, a specially crafted packet could be used to trigger an infinite loop resulting in a denial of service. This was fixed with commit b90d4fc1. This issue was first reported to the Apach...

PT-2021-7985

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 8.5.7 through 8.5.63 Apache Tomcat versions 9.0.0-M11 through 9.0.43 Description The issue is related to the generation of error messages containing sensitive information in Apache Tomcat. Incomplete POST requests can...

Apache Tomcat 9.0.0.M1 < 9.0.43 Multiple Vulnerabilities

The version of Apache Tomcat installed on the remote host is 10.0.0-M1 to 10.0.1, 9.0.0.M1 to 9.0.42, 8.5.0 to 8.5.62 or 7.0.0 to 7.0.107. It is, therefore, affected by a remote code execution due to an incomplete fix for CVE-2020-9484 and an information diclosure due to request mix-up with h2c...

Apache Tomcat 7.0.0 < 7.0.108 multiple vulnerabilities

The version of Tomcat installed on the remote host is prior to 7.0.108. It is, therefore, affected by a vulnerability as referenced in the fixedinapachetomcat7.0.108security-7 advisory. - The fix for CVE-2020-9484 was incomplete. When using Apache Tomcat 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41,...

Apache Tomcat 8.5.x < 8.5.63 Multiple Vulnerabilities

The version of Apache Tomcat installed on the remote host is 10.0.0-M1 to 10.0.1, 9.0.0.M1 to 9.0.42, 8.5.0 to 8.5.62 or 7.0.0 to 7.0.107. It is, therefore, affected by a remote code execution due to an incomplete fix for CVE-2020-9484 and an information diclosure due to request mix-up with h2c...

Apache Tomcat 10.0.0-M1 < 10.0.2 Multiple Vulnerabilities

The version of Apache Tomcat installed on the remote host is 10.0.0-M1 to 10.0.1, 9.0.0.M1 to 9.0.42, 8.5.0 to 8.5.62 or 7.0.0 to 7.0.107. It is, therefore, affected by a remote code execution due to an incomplete fix for CVE-2020-9484 and an information diclosure due to request mix-up with h2c...

Apache Tomcat 7.0.x < 7.0.108 Multiple Vulnerabilities

The version of Apache Tomcat installed on the remote host is 10.0.0-M1 to 10.0.1, 9.0.0.M1 to 9.0.42, 8.5.0 to 8.5.62 or 7.0.0 to 7.0.107. It is, therefore, affected by a remote code execution due to an incomplete fix for CVE-2020-9484 and an information diclosure due to request mix-up with h2c...

Apache Tomcat 9.0.0.M1 < 9.0.43 multiple vulnerabilities

The version of Tomcat installed on the remote host is prior to 9.0.43. It is, therefore, affected by multiple vulnerabilities as referenced in the fixedinapachetomcat9.0.43security-9 advisory. - The fix for CVE-2020-9484 was incomplete. When using Apache Tomcat 10.0.0-M1 to 10.0.0, 9.0.0.M1 to...

Apache Tomcat 8.5.0 < 8.5.63 multiple vulnerabilities

The version of Tomcat installed on the remote host is prior to 8.5.63. It is, therefore, affected by multiple vulnerabilities as referenced in the fixedinapachetomcat8.5.63security-8 advisory. - The fix for CVE-2020-9484 was incomplete. When using Apache Tomcat 10.0.0-M1 to 10.0.0, 9.0.0.M1 to...

CVE-2021-25329

The fix for CVE-2020-9484 was incomplete. When using Apache Tomcat 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41, 8.5.0 to 8.5.61 or 7.0.0. to 7.0.107 with a configuration edge case that was highly unlikely to be used, the Tomcat instance was still vulnerable to CVE-2020-9494. Note that both the...

CVE-2021-25122

A flaw was found in Apache Tomcat. When responding to new h2c connection requests, Apache Tomcat could duplicate request headers and a limited amount of request body from one request to another meaning user A and user B could both see the results of user A's request. The highest threat from this...

Security Bulletin: Open Source Apache Tomcat vulnerabilities affect IBM Tivoli Application Dependency Discovery Manager (CVE-2021-24122)

Summary Multiple vulnerabilities in Open Source Apache Tomcat reported by The Apache Software Foundation affect IBM Tivoli Application Dependency Discovery Manager TADDM Vulnerability Details CVEID: CVE-2021-24122 DESCRIPTION: Apache Tomcat could allow a remote attacker to obtain sensitive...

Apache Tomcat Information Disclosure Vulnerability (Mar 2021) - Windows

Apache Tomcat is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:apache:tomcat"...

Apache Tomcat RCE Vulnerability (Mar 2021) - Windows

Apache Tomcat is prone to a remote code execution RCE vulnerability due to an incomplete fix. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only C...

Apache Tomcat RCE Vulnerability (Mar 2021) - Linux

Apache Tomcat is prone to a remote code execution RCE vulnerability due to an incomplete fix. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only C...

Apache Tomcat Information Disclosure Vulnerability (Mar 2021) - Linux

Apache Tomcat is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:apache:tomcat"...