CVE-2021-25122
🟡 Monitoruj
Duplikacja nagłówków w Apache Tomcat pozwala użytkownikom na dostęp do wyników żądań innych.
CVSS: źródło nieustalone · szczegóły: D1
CVSS
7.5
EPSS
18.1%
Exploit
none
Vendor
apache
Opis źródłowy (NVD)
When responding to new h2c connection requests, Apache Tomcat versions 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41 and 8.5.0 to 8.5.61 could duplicate request headers and a limited amount of request body from one request to another meaning user A and user B could both see the results of user A's request.
brak
Status patcha: nieustalony
Źródła i daty
| Źródło | Wartość |
|---|---|
| NVD – CVSS | 7.5 |
| CISA KEV (aktywnie wykorzystywane) | Nie |
| FIRST EPSS · ocena nieustalona | 18.1% |
| Opublikowano (NVD) | 2021-03-01 12:15:13 UTC |
| Ostatnia modyfikacja (NVD) | 2026-10-08 22:17:08 UTC |
Referencje
- http://www.openwall.com/lists/oss-security/2021/03/01/1 ([email protected]) [Mailing List, Third Party Advisory]
- https://lists.apache.org/thread.html/r7b95bc248603360501f18c8eb03bb6001ec0ee3296205b34b07105b7%40%3Cannounce.apache.org%3E ([email protected])
- https://lists.apache.org/thread.html/r7b95bc248603360501f18c8eb03bb6001ec0ee3296205b34b07105b7%40%3Cannounce.tomcat.apache.org%3E ([email protected]) [Mailing List, Vendor Advisory]
- https://lists.apache.org/thread.html/r7b95bc248603360501f18c8eb03bb6001ec0ee3296205b34b07105b7%40%3Cdev.tomcat.apache.org%3E ([email protected])
- https://lists.apache.org/thread.html/r7b95bc248603360501f18c8eb03bb6001ec0ee3296205b34b07105b7%40%3Cusers.tomcat.apache.org%3E ([email protected])
- https://lists.apache.org/thread.html/rcd90bf36b1877e1310b87ecd14ed7bbb15da52b297efd9f0e7253a3b%40%3Cusers.tomcat.apache.org%3E ([email protected])
- https://lists.apache.org/thread.html/rd0463f9a5cbc02a485404c4b990f0da452e5ac5c237808edba11c947%40%3Cusers.tomcat.apache.org%3E ([email protected])
- https://lists.apache.org/thread.html/rf6d5d57b114678d8898005faef31e9fd6d7c981fcc4ccfc3bc272fc9%40%3Cdev.tomcat.apache.org%3E ([email protected])
- https://lists.debian.org/debian-lts-announce/2021/03/msg00018.html ([email protected]) [Mailing List, Third Party Advisory]
- https://security.gentoo.org/glsa/202208-34 ([email protected]) [Third Party Advisory]
- https://security.netapp.com/advisory/ntap-20210409-0002/ ([email protected]) [Third Party Advisory]
- https://www.debian.org/security/2021/dsa-4891 ([email protected]) [Third Party Advisory]
- https://www.oracle.com//security-alerts/cpujul2021.html ([email protected]) [Patch, Third Party Advisory]
- https://www.oracle.com/security-alerts/cpujan2022.html ([email protected]) [Patch, Third Party Advisory]
- https://www.oracle.com/security-alerts/cpuoct2021.html ([email protected]) [Patch, Third Party Advisory]