CVE-2021-43980
Low
Description
The simplified implementation of blocking reads and writes introduced in Tomcat 10 and back-ported to Tomcat 9.0.47 onwards exposed a long standing (but extremely hard to trigger) concurrency bug in Apache Tomcat 10.1.0 to 10.1.0-M12, 10.0.0-M1 to 10.0.18, 9.0.0-M1 to 9.0.60 and 8.5.0 to 8.5.77 that could cause client connections to share an Http11Processor instance resulting in responses, or part responses, to be received by the wrong client.
SeverityLow
CVSS3.7
Exploit probability—
Product
Apache Tomcat
PublishedSep 28, 2022
First seenSep 28, 2022
Weakness typeCWE-362Race condition
How to fix
Update
- org.apache.tomcat:tomcat8.5.78, 9.0.62, 10.0.20, 10.1.0-M14 or later
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache tomcat | 8.5.0 ≤ v ≤ 8.5.77, 9.0.0 ≤ v ≤ 9.0.60, 10.0.0 ≤ v ≤ 10.0.18, 10.1.0 | — |
| debian debian_linux | 10.0, 11.0 | — |
| org.apache.tomcat:tomcatMaven | 8.5.0 ≤ v < 8.5.78, 9.0.0-M1 ≤ v < 9.0.62, 10.0.0-M1 ≤ v < 10.0.20, 10.1.0-M1 ≤ v < 10.1.0-M14 | 8.5.78, 9.0.62, 10.0.20, 10.1.0-M14 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.