CVE-2021-25329: Apache Tomcat Incomplete Fix for CVE-2020-9484
Summary
CVE-2021-25329: Incomplete fix for CVE-2020-9484. Affects tomcat across 41 version ranges.
>= 7.0.0, < 7.0.108
>= 8.5.0, < 8.5.62
>= 9.0.0, < 9.0.42
>= 9.0.0-milestone1, < 9.0.0
>= 9.0.0-milestone2, < 9.0.0
>= 9.0.0-milestone3, < 9.0.0
>= 9.0.0-milestone4, < 9.0.0
>= 9.0.0-milestone5, < 9.0.0
>= 9.0.0-milestone6, < 9.0.0
>= 9.0.0-milestone7, < 9.0.0
>= 9.0.0-milestone8, < 9.0.0
>= 9.0.0-milestone9, < 9.0.0
>= 9.0.0-milestone10, < 9.0.0
>= 9.0.0-milestone11, < 9.0.0
>= 9.0.0-milestone12, < 9.0.0
>= 9.0.0-milestone13, < 9.0.0
>= 9.0.0-milestone14, < 9.0.0
>= 9.0.0-milestone15, < 9.0.0
>= 9.0.0-milestone16, < 9.0.0
>= 9.0.0-milestone17, < 9.0.0
>= 9.0.0-milestone18, < 9.0.0
>= 9.0.0-milestone19, < 9.0.0
>= 9.0.0-milestone20, < 9.0.0
>= 9.0.0-milestone21, < 9.0.0
>= 9.0.0-milestone22, < 9.0.0
>= 9.0.0-milestone23, < 9.0.0
>= 9.0.0-milestone24, < 9.0.0
>= 9.0.0-milestone25, < 9.0.0
>= 9.0.0-milestone26, < 9.0.0
>= 9.0.0-milestone27, < 9.0.0
>= 10.0.0, < 10.0.1
>= 10.0.0-milestone1, < 10.0.0
>= 10.0.0-milestone2, < 10.0.0
>= 10.0.0-milestone3, < 10.0.0
>= 10.0.0-milestone4, < 10.0.0
>= 10.0.0-milestone5, < 10.0.0
>= 10.0.0-milestone6, < 10.0.0
>= 10.0.0-milestone7, < 10.0.0
>= 10.0.0-milestone8, < 10.0.0
>= 10.0.0-milestone9, < 10.0.0
>= 10.0.0-milestone10, < 10.0.0
Fixed in 6 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- org.apache.tomcat.embed:tomcat-embed-core · Maven
- tomcat9 · Debian:11
The same CVE-2021-25329 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Tomcat is an open-source web server and servlet container that is widely used for hosting Java-based web applications. It provides a robust and scalable platform for running Java web applications. However, a vulnerability has been discovered in Apache Tomcat versions 7.0.0 to 7.0.107, 8.5.0 to 8.5.61, 9.0.0 to 9.0.41, and 10.0.0-M1 to 10.0.0. This vulnerability, known as CVE-2021-25329, is an incomplete fix for a previously reported vulnerability, CVE-2020-9484.
Vulnerability Detail
CVE-2021-25329 is a high-severity vulnerability that affects Apache Tomcat. The fix for CVE-2020-9484, which was intended to address a remote code execution vulnerability, was incomplete. In certain edge cases that are unlikely to be used, the Tomcat instance remains vulnerable to CVE-2020-9494. This means that an attacker could potentially exploit this vulnerability to execute arbitrary code on the affected system. It is important to note that the prerequisites and mitigations for CVE-2020-9484 also apply to this issue.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 7.0.0, < 7.0.1087.0.108 -
>= 8.5.0, < 8.5.628.5.62 -
>= 9.0.0-milestone1, < 9.0.09.0.0 -
>= 9.0.0-milestone2, < 9.0.09.0.0 -
>= 9.0.0-milestone3, < 9.0.09.0.0 -
>= 9.0.0-milestone4, < 9.0.09.0.0
Show all 41 release lines
-
>= 9.0.0-milestone5, < 9.0.09.0.0 -
>= 9.0.0-milestone6, < 9.0.09.0.0 -
>= 9.0.0-milestone7, < 9.0.09.0.0 -
>= 9.0.0-milestone8, < 9.0.09.0.0 -
>= 9.0.0-milestone9, < 9.0.09.0.0 -
>= 9.0.0-milestone10, < 9.0.09.0.0 -
>= 9.0.0-milestone11, < 9.0.09.0.0 -
>= 9.0.0-milestone12, < 9.0.09.0.0 -
>= 9.0.0-milestone13, < 9.0.09.0.0 -
>= 9.0.0-milestone14, < 9.0.09.0.0 -
>= 9.0.0-milestone15, < 9.0.09.0.0 -
>= 9.0.0-milestone16, < 9.0.09.0.0 -
>= 9.0.0-milestone17, < 9.0.09.0.0 -
>= 9.0.0-milestone18, < 9.0.09.0.0 -
>= 9.0.0-milestone19, < 9.0.09.0.0 -
>= 9.0.0-milestone20, < 9.0.09.0.0 -
>= 9.0.0-milestone21, < 9.0.09.0.0 -
>= 9.0.0-milestone22, < 9.0.09.0.0 -
>= 9.0.0-milestone23, < 9.0.09.0.0 -
>= 9.0.0-milestone24, < 9.0.09.0.0 -
>= 9.0.0-milestone25, < 9.0.09.0.0 -
>= 9.0.0-milestone26, < 9.0.09.0.0 -
>= 9.0.0-milestone27, < 9.0.09.0.0 -
>= 9.0.0, < 9.0.429.0.42 -
>= 10.0.0-milestone1, < 10.0.010.0.0 -
>= 10.0.0-milestone2, < 10.0.010.0.0 -
>= 10.0.0-milestone3, < 10.0.010.0.0 -
>= 10.0.0-milestone4, < 10.0.010.0.0 -
>= 10.0.0-milestone5, < 10.0.010.0.0 -
>= 10.0.0-milestone6, < 10.0.010.0.0 -
>= 10.0.0-milestone7, < 10.0.010.0.0 -
>= 10.0.0-milestone8, < 10.0.010.0.0 -
>= 10.0.0-milestone9, < 10.0.010.0.0 -
>= 10.0.0-milestone10, < 10.0.010.0.0 -
>= 10.0.0, < 10.0.110.0.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a possible workaround is to disable the affected feature or configuration that triggers the vulnerability. However, this workaround should only be considered as a temporary measure until the system can be upgraded to a patched version.
Conclusion
CVE-2021-25329 is a high-severity vulnerability in Apache Tomcat that requires immediate attention. Users are advised to upgrade to the latest version of Apache Tomcat to ensure that the vulnerability is properly patched. If upgrading is not immediately feasible, a temporary workaround can be implemented. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tomcat →
FAQ
Apache Tomcat is an open-source web server and servlet container that is widely used for hosting Java-based web applications.
CVE-2021-25329 is a high-severity vulnerability in Apache Tomcat that is an incomplete fix for a previously reported vulnerability, CVE-2020-9484.
This vulnerability could allow an attacker to execute arbitrary code on the affected system, potentially leading to unauthorized access, data breaches, or system compromise.
To fix this vulnerability, it is recommended to upgrade to the latest version of Apache Tomcat that includes the patch for CVE-2021-25329.
If immediate upgrade is not possible, a temporary workaround is to disable the affected feature or configuration that triggers the vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for tomcat.
