Apache Tomcat 8.5.0 to 8.5.63, 9.0.0-M1 to 9.0.43 and 10.0.0-M1 to 10.0.2 did not properly validate incoming TLS packets. When Tomcat was configured to use NIO+OpenSSL or NIO2+OpenSSL for TLS, a specially crafted packet could be used to trigger an infinite loop resulting in a denial of service.
CVE-2021-41079 - High Severity Vulnerability
Core Tomcat implementation
Library home page: https://tomcat.apache.org/
Path to dependency file: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/apache/tomcat/embed/tomcat-embed-core/9.0.41/tomcat-embed-core-9.0.41.jar
Dependency Hierarchy: - spring-boot-starter-web-2.4.2.jar (Root Library) - spring-boot-starter-tomcat-2.4.2.jar - :x: **tomcat-embed-core-9.0.41.jar** (Vulnerable Library)
Found in HEAD commit: 338ae0024bb25a8bbd720eae5b5fbae3875c4bf3
Found in base branch: master
Apache Tomcat 8.5.0 to 8.5.63, 9.0.0-M1 to 9.0.43 and 10.0.0-M1 to 10.0.2 did not properly validate incoming TLS packets. When Tomcat was configured to use NIO+OpenSSL or NIO2+OpenSSL for TLS, a specially crafted packet could be used to trigger an infinite loop resulting in a denial of service.
Publish Date: 2021-09-16
URL: CVE-2021-41079
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here.Type: Upgrade version
Origin: https://tomcat.apache.org/security-10.html
Release Date: 2021-09-16
Fix Resolution (org.apache.tomcat.embed:tomcat-embed-core): 9.0.44
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-web): 2.4.4
:rescue_worker_helmet: Automatic Remediation is available for this issue