Uploaded image for project: 'OFBiz'
  1. OFBiz
  2. OFBIZ-1525 Issue to group security concerns
  3. OFBIZ-12337

[SECURITY] CVE-2021-42340 Apache Tomcat DoS

Attach filesAttach ScreenshotVotersWatch issueWatchersLinkCloneUpdate Comment AuthorReplace String in CommentUpdate Comment VisibilityDelete Comments
    XMLWordPrintableJSON

Details

    • Bug Crush Event - 21/2/2015

    Description

      CVE-2021-42340 Denial of Service

      Severity: Important

      Vendor: The Apache Software Foundation

      Versions Affected:
      Apache Tomcat 10.1.0-M1 to 10.1.0-M5
      Apache Tomcat 10.0.0-M10 to 10.0.11
      Apache Tomcat 9.0.40 to 9.0.53
      Apache Tomcat 8.5.60 to 8.5.71

      Description:
      The fix for bug 63362 introduced a memory leak. The object introduced to collect metrics for HTTP upgrade connections was not released for WebSocket connections once the WebSocket connection was closed. This created a memory leak that, over time, could lead to a denial of service via an OutOfMemoryError.

      Mitigation:
      Users of the affected versions should apply one of the following
      mitigations:

      • Upgrade to Apache Tomcat 10.1.0-M6 or later
      • Upgrade to Apache Tomcat 10.0.12 or later
      • Upgrade to Apache Tomcat 9.0.54 or later
      • Upgrade to Apache Tomcat 8.5.72 or later

      History:
      2021-10-14 Original advisory
      2021-10-14 Correct CVE reference in body of advisory

      References:
      [1] https://tomcat.apache.org/security-10.html
      [2] https://tomcat.apache.org/security-9.html
      [3] https://tomcat.apache.org/security-8.html

      Attachments

        Activity

          This comment will be Viewable by All Users Viewable by All Users
          Cancel

          People

            jleroux Jacques Le Roux
            jleroux Jacques Le Roux
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved:

              Agile

                Completed Sprint:
                Bug Crush Event - 21/2/2015 ended 26/Feb/15
                View on Board

                Slack

                  Issue deployment