CVE-2021-43980

The simplified implementation of blocking reads and writes introduced in Tomcat 10 and back-ported to Tomcat 9.0.47 onwards exposed a long standing (but extremely hard to trigger) concurrency bug in Apache Tomcat 10.1.0 to 10.1.0-M12, 10.0.0-M1 to 10.0.18, 9.0.0-M1 to 9.0.60 and 8.5.0 to 8.5.77 that could cause client connections to share an Http11Processor instance resulting in responses, or part responses, to be received by the wrong client.

CVSS v3 3.7 LOW

3.7^/10

CVSS v3 : LOW

V3 Legend

Vector :

Exploitability : 2.2 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
http://www.openwall.com/lists/oss-security/2022/09/28/1	Mailing List Third Party Advisory
https://lists.apache.org/thread/3jjqbsp6j88b198x5rmg99b1qr8ht3g3	Mailing List Vendor Advisory
https://lists.debian.org/debian-lts-announce/2022/10/msg00029.html	Mailing List Third Party Advisory
https://www.debian.org/security/2022/dsa-5265	Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:apache:tomcat::::::::
	cpe:2.3:a:apache:tomcat::::::::
	cpe:2.3:a:apache:tomcat::::::::
	cpe:2.3:a:apache:tomcat:10.1.0:milestone1::::::
	cpe:2.3:a:apache:tomcat:10.1.0:milestone10::::::
	cpe:2.3:a:apache:tomcat:10.1.0:milestone11::::::
	cpe:2.3:a:apache:tomcat:10.1.0:milestone12::::::
	cpe:2.3:a:apache:tomcat:10.1.0:milestone2::::::
	cpe:2.3:a:apache:tomcat:10.1.0:milestone3::::::
	cpe:2.3:a:apache:tomcat:10.1.0:milestone4::::::
	cpe:2.3:a:apache:tomcat:10.1.0:milestone5::::::
	cpe:2.3:a:apache:tomcat:10.1.0:milestone6::::::
	cpe:2.3:a:apache:tomcat:10.1.0:milestone7::::::
	cpe:2.3:a:apache:tomcat:10.1.0:milestone8::::::
	cpe:2.3:a:apache:tomcat:10.1.0:milestone9::::::

Configuration 2 (hide)

OR	cpe:2.3:o:debian:debian_linux:10.0:::::::*
	cpe:2.3:o:debian:debian_linux:11.0:::::::*

History

10 Nov 2022, 04:00

Type	Values Removed	Values Added
CPE		cpe:2.3:o:debian:debian_linux:10.0:::::::* cpe:2.3:o:debian:debian_linux:11.0:::::::*
First Time		Debian debian Linux Debian
References	~~(MLIST) https://lists.debian.org/debian-lts-announce/2022/10/msg00029.html -~~	(MLIST) https://lists.debian.org/debian-lts-announce/2022/10/msg00029.html - Mailing List, Third Party Advisory
References	~~(DEBIAN) https://www.debian.org/security/2022/dsa-5265 -~~	(DEBIAN) https://www.debian.org/security/2022/dsa-5265 - Third Party Advisory

30 Oct 2022, 04:15

Type	Values Removed	Values Added
References		(DEBIAN) https://www.debian.org/security/2022/dsa-5265 -

26 Oct 2022, 15:15

Type	Values Removed	Values Added
References		(MLIST) https://lists.debian.org/debian-lts-announce/2022/10/msg00029.html -

05 Oct 2022, 17:12

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~5.3~~	v2 : unknown v3 : 3.7
CPE	cpe:2.3:a:apache:tomcat:10.0.0:milestone10:::::: cpe:2.3:a:apache:tomcat:10.0.0:milestone1:::::: cpe:2.3:a:apache:tomcat:9.0.0:milestone4:::::: cpe:2.3:a:apache:tomcat:10.0.0:milestone6:::::: cpe:2.3:a:apache:tomcat:10.0.0:milestone9:::::: cpe:2.3:a:apache:tomcat:10.0.0:milestone4:::::: cpe:2.3:a:apache:tomcat:9.0.0:milestone8:::::: cpe:2.3:a:apache:tomcat:10.0.0:milestone7:::::: cpe:2.3:a:apache:tomcat:9.0.0:milestone9:::::: cpe:2.3:a:apache:tomcat:9.0.0:milestone3:::::: cpe:2.3:a:apache:tomcat:9.0.0:milestone2:::::: cpe:2.3:a:apache:tomcat:10.0.0:milestone8:::::: cpe:2.3:a:apache:tomcat:9.0.0:milestone7:::::: cpe:2.3:a:apache:tomcat:9.0.0:milestone5:::::: cpe:2.3:a:apache:tomcat:9.0.0:milestone1:::::: cpe:2.3:a:apache:tomcat:10.0.0:milestone5:::::: cpe:2.3:a:apache:tomcat:9.0.0:milestone6:::::: cpe:2.3:a:apache:tomcat:10.0.0:milestone3:::::: cpe:2.3:a:apache:tomcat:10.0.0:milestone2::::::	cpe:2.3:a:apache:tomcat:10.1.0:milestone3:::::: cpe:2.3:a:apache:tomcat:10.1.0:milestone10:::::: cpe:2.3:a:apache:tomcat:10.1.0:milestone4:::::: cpe:2.3:a:apache:tomcat:10.1.0:milestone11:::::: cpe:2.3:a:apache:tomcat:10.1.0:milestone2:::::: cpe:2.3:a:apache:tomcat:10.1.0:milestone6:::::: cpe:2.3:a:apache:tomcat:10.1.0:milestone5:::::: cpe:2.3:a:apache:tomcat:10.1.0:milestone8:::::: cpe:2.3:a:apache:tomcat:10.1.0:milestone12:::::: cpe:2.3:a:apache:tomcat:10.1.0:milestone1:::::: cpe:2.3:a:apache:tomcat:10.1.0:milestone7:::::: cpe:2.3:a:apache:tomcat:10.1.0:milestone9::::::

30 Sep 2022, 18:55

Type	Values Removed	Values Added
CPE		cpe:2.3:a:apache:tomcat:10.0.0:milestone10:::::: cpe:2.3:a:apache:tomcat:10.0.0:milestone7:::::: cpe:2.3:a:apache:tomcat:9.0.0:milestone9:::::: cpe:2.3:a:apache:tomcat:9.0.0:milestone3:::::: cpe:2.3:a:apache:tomcat:10.0.0:milestone1:::::: cpe:2.3:a:apache:tomcat:9.0.0:milestone2:::::: cpe:2.3:a:apache:tomcat:10.0.0:milestone8:::::: cpe:2.3:a:apache:tomcat:9.0.0:milestone4:::::: cpe:2.3:a:apache:tomcat:::::::: cpe:2.3:a:apache:tomcat:10.0.0:milestone6:::::: cpe:2.3:a:apache:tomcat:9.0.0:milestone7:::::: cpe:2.3:a:apache:tomcat:9.0.0:milestone5:::::: cpe:2.3:a:apache:tomcat:10.0.0:milestone9:::::: cpe:2.3:a:apache:tomcat:9.0.0:milestone1:::::: cpe:2.3:a:apache:tomcat:10.0.0:milestone4:::::: cpe:2.3:a:apache:tomcat:9.0.0:milestone8:::::: cpe:2.3:a:apache:tomcat:10.0.0:milestone5:::::: cpe:2.3:a:apache:tomcat:9.0.0:milestone6:::::: cpe:2.3:a:apache:tomcat:10.0.0:milestone3:::::: cpe:2.3:a:apache:tomcat:10.0.0:milestone2::::::
First Time		Apache Apache tomcat
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 5.3
CWE		CWE-362
References	~~(MISC) https://lists.apache.org/thread/3jjqbsp6j88b198x5rmg99b1qr8ht3g3 -~~	(MISC) https://lists.apache.org/thread/3jjqbsp6j88b198x5rmg99b1qr8ht3g3 - Mailing List, Vendor Advisory
References	~~(MLIST) http://www.openwall.com/lists/oss-security/2022/09/28/1 -~~	(MLIST) http://www.openwall.com/lists/oss-security/2022/09/28/1 - Mailing List, Third Party Advisory

28 Sep 2022, 15:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2022-09-28 14:15

Updated : 2023-12-10 14:35

NVD link : CVE-2021-43980

Mitre link : CVE-2021-43980

CVE.ORG link : CVE-2021-43980

JSON object : View

Products Affected

debian

debian_linux

apache

tomcat

CWE

CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

3.7 /10