Apache Tomcat: Information disclosure
CVE-2021-43980

3.7LOW

Key Information:

Vendor
Apache
Status
Apache Tomcat
Vendor
CVE Published:
28 September 2022

Summary

The simplified implementation of blocking reads and writes introduced in Tomcat 10 and back-ported to Tomcat 9.0.47 onwards exposed a long standing (but extremely hard to trigger) concurrency bug in Apache Tomcat 10.1.0 to 10.1.0-M12, 10.0.0-M1 to 10.0.18, 9.0.0-M1 to 9.0.60 and 8.5.0 to 8.5.77 that could cause client connections to share an Http11Processor instance resulting in responses, or part responses, to be received by the wrong client.

Affected Version(s)

Apache Tomcat 10.1.0-M1 to 10.1.0-M12

Apache Tomcat 10.0.0-M1 to 10.0.18

Apache Tomcat 9.0.0-M1 to 9.0.60

References

https://lists.apache.org/thread/3jjqbsp6j88b198x5rmg99b1q...
http://www.openwall.com/lists/oss-security/2022/09/28/1
mailing-list
https://lists.debian.org/debian-lts-announce/2022/10/msg0...
mailing-list

CVSS V3.1

Score:
3.7
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Thanks to Adam Thomas, Richard Hernandez and Ryan Schmitt for discovering the issue and working with the Tomcat security team to identify the root cause and appropriate fix.
.