CVE-2021-43980: Apache Tomcat Concurrency Bug
Summary
CVE-2021-43980: Apache Tomcat: Information disclosure. Affects tomcat across 15 version ranges.
>= 8.5.0, < 8.5.78
>= 9.0.0, < 9.0.61
>= 10.0.0, < 10.0.19
>= 10.1.0-milestone1, < 10.1.0
>= 10.1.0-milestone2, < 10.1.0
>= 10.1.0-milestone3, < 10.1.0
>= 10.1.0-milestone4, < 10.1.0
>= 10.1.0-milestone5, < 10.1.0
>= 10.1.0-milestone6, < 10.1.0
>= 10.1.0-milestone7, < 10.1.0
>= 10.1.0-milestone8, < 10.1.0
>= 10.1.0-milestone9, < 10.1.0
>= 10.1.0-milestone10, < 10.1.0
>= 10.1.0-milestone11, < 10.1.0
>= 10.1.0-milestone12, < 10.1.0
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- org.apache.tomcat:tomcat · Maven
- tomcat9 · Debian:11
The same CVE-2021-43980 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Tomcat is an open-source web server and servlet container that is widely used for hosting Java-based web applications. It provides a robust and scalable platform for running Java web applications. This vulnerability affects versions 8.5.0 to 8.5.77, 9.0.0 to 9.0.60, 10.0.0 to 10.0.18, and 10.1.0 to 10.1.0-M12 of Apache Tomcat. The vulnerability arises from a concurrency bug introduced in Tomcat 10 and back-ported to Tomcat 9.0.47 onwards. This bug can cause client connections to share an Http11Processor instance, resulting in responses or part responses being received by the wrong client.
Vulnerability Detail
The simplified implementation of blocking reads and writes in Apache Tomcat introduced a concurrency bug that can lead to responses being received by the wrong client. This bug is extremely hard to trigger but can have serious consequences if exploited. An attacker could potentially intercept sensitive information or manipulate the responses received by clients. The bug affects multiple versions of Apache Tomcat, making it important for users to update to the fixed versions to mitigate the risk.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 8.5.0, < 8.5.788.5.78 -
>= 9.0.0, < 9.0.619.0.61 -
>= 10.0.0, < 10.0.1910.0.19 -
>= 10.1.0-milestone1, < 10.1.010.1.0 -
>= 10.1.0-milestone2, < 10.1.010.1.0 -
>= 10.1.0-milestone3, < 10.1.010.1.0
Show all 15 release lines
-
>= 10.1.0-milestone4, < 10.1.010.1.0 -
>= 10.1.0-milestone5, < 10.1.010.1.0 -
>= 10.1.0-milestone6, < 10.1.010.1.0 -
>= 10.1.0-milestone7, < 10.1.010.1.0 -
>= 10.1.0-milestone8, < 10.1.010.1.0 -
>= 10.1.0-milestone9, < 10.1.010.1.0 -
>= 10.1.0-milestone10, < 10.1.010.1.0 -
>= 10.1.0-milestone11, < 10.1.010.1.0 -
>= 10.1.0-milestone12, < 10.1.010.1.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. Users are advised to upgrade to the fixed versions as soon as possible.
Conclusion
The Apache Tomcat Concurrency Bug (CVE-2021-43980) is a serious vulnerability that can lead to responses being received by the wrong client. It is important for users to upgrade to the fixed versions to mitigate the risk of information disclosure or response manipulation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tomcat →
FAQ
Apache Tomcat is an open-source web server and servlet container that is widely used for hosting Java-based web applications.
Versions 8.5.0 to 8.5.77, 9.0.0 to 9.0.60, 10.0.0 to 10.0.18, and 10.1.0 to 10.1.0-M12 of Apache Tomcat are affected by this vulnerability.
This vulnerability can allow client connections to share an Http11Processor instance, resulting in responses or part responses being received by the wrong client. This can potentially lead to information disclosure or manipulation of responses.
No, there is no known workaround for this vulnerability. Users are advised to upgrade to the fixed versions.
To fix this vulnerability, users should upgrade their Apache Tomcat installations to the fixed versions. See the 'how_to_fix' section for specific version numbers.
Related vulnerabilities
Recent vulnerabilities recorded for tomcat.
