CVE-2021-41079

 

Published at: - 16-09-2021 05:15

Last modified: - 25-10-2022 08:36

Total changes: - 8

Description

Apache Tomcat 8.5.0 to 8.5.63, 9.0.0-M1 to 9.0.43 and 10.0.0-M1 to 10.0.2 did not properly validate incoming TLS packets. When Tomcat was configured to use NIO+OpenSSL or NIO2+OpenSSL for TLS, a specially crafted packet could be used to trigger an infinite loop resulting in a denial of service.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

 

Verification logic

 

Reference

• https://lists.apache.org/thread.html/rccdef0349fdf4fb73a4e4403095446d7fe6264e0a58e2df5c6799434%40%3Cannounce.tomcat.apache.org%3E
• [debian-lts-announce] 20210922 [SECURITY] [DLA 2764-1] tomcat8 security update-Mailing List, Third Party Advisory
• https://security.netapp.com/advisory/ntap-20211008-0005/
• [tomcat-users] 20211014 [SECURITY] CVE-2021-42340 Apache Tomcat DoS-Mailing List, Vendor Advisory
• [tomcat-dev] 20211014 [SECURITY] CVE-2021-42340 Apache Tomcat DoS-Mailing List, Vendor Advisory
• DSA-4986-Third Party Advisory

 

Keywords

NVD

 

CVE-2021-41079

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures