CVE-2021-25122
High
Description
When responding to new h2c connection requests, Apache Tomcat versions 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41 and 8.5.0 to 8.5.61 could duplicate request headers and a limited amount of request body from one request to another meaning user A and user B could both see the results of user A's request.
SeverityHigh
CVSS7.5
Exploit probability—
Product
Apache Tomcat
PublishedMar 1, 2021
First seenMar 1, 2021
Weakness typeCWE-200Sensitive information exposure
How to fix
Update
- oracle graph_server_and_client21.3.0 or later
- org.apache.tomcat.embed:tomcat-embed-core10.0.2, 9.0.43, 8.5.63 or later
- org.apache.tomcat:tomcat-coyote10.0.2 or later
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache tomcat | 8.5.0 ≤ v ≤ 8.5.61, 9.0.0 ≤ v ≤ 9.0.41, 9.0.0, 10.0.0 | — |
| debian debian_linux | 9.0, 10.0 | — |
| oracle agile_product_lifecycle_management | 9.3.3, 9.3.6 | — |
| oracle communications_cloud_native_core_policy | 1.14.0 | — |
| oracle communications_cloud_native_core_security_edge_protection_proxy | 1.6.0 | — |
| oracle communications_instant_messaging_server | 10.0.1.5.0 | — |
| oracle database | 12.2.0.1, 19c, 21c | — |
| oracle graph_server_and_client | v < 21.3.0, 21.3.0 | 21.3.0 |
| oracle instantis_enterprisetrack | 17.1, 17.2, 17.3 | — |
| oracle managed_file_transfer | 12.2.1.3.0, 12.2.1.4.0 | — |
| oracle mysql_enterprise_monitor | v ≤ 8.0.23 | — |
| oracle siebel_ui_framework | v ≤ 21.9 | — |
| org.apache.tomcat.embed:tomcat-embed-coreMaven | 10.0.0-M1 ≤ v < 10.0.2, 9.0.0-M1 ≤ v < 9.0.43, 8.5.0 ≤ v < 8.5.63 | 10.0.2, 9.0.43, 8.5.63 |
| org.apache.tomcat:tomcat-coyoteMaven | 10.0.0-M1 ≤ v < 10.0.2 | 10.0.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.