Alerts This Week
Warning Icon 1 692
Alerts This Week
Warning Icon 1 692

Mageia 8: MGASA-2021-0358 Important: Tomcat Remote Access Vulnerability

mageia
Calendar Grey July 20, 2021
Dist Mageia Esm H88
Newly released updates for Apache Tomcat address a serious vulnerability within Mageia. User data might be exposed across different sessions.
When responding to new h2c connection requests, Apache Tomcat versions 9.0.0.M1 to 9.0.41 could duplicate request headers and a limited amount of request body from one request to ...

Summary

When responding to new h2c connection requests, Apache Tomcat versions 9.0.0.M1 to 9.0.41 could duplicate request headers and a limited amount of request body from one request to another meaning user A and user B could both see the results of user A's request (CVE-2021-25122).
The fix for CVE-2020-9484 was incomplete. When using Apache Tomcat 9.0.0.M1 to 9.0.41 with a configuration edge case that was highly unlikely to be used, the Tomcat instance was still vulnerable to CVE-2020-9494 (CVE-2021-25329).

References

- https://bugs.mageia.org/show_bug.cgi?id=28501

- https://www.openwall.com/lists/oss-security/2021/03/01/1

- https://www.openwall.com/lists/oss-security/2021/03/01/2

- https://tomcat.apache.org/security-9.html

-

- https://lists.debian.org/debian-security-announce/2021/msg00072.html

- https://www.cve.org/CVERecord?id=CVE-2021-25122

- https://www.cve.org/CVERecord?id=CVE-2021-25329

Topics%20covered

Topics Covered

security advisory critical security fix Tomcat Mageia request exposure user session

Resolution

SRPMS

- 8/core/tomcat-9.0.41-1.2.mga8

Severity
important
Lowest
Low
Medium
High
Critical

Publication date: 20 Jul 2021
URL: https://advisories.mageia.org/MGASA-2021-0357.html
Type: security
CVE: CVE-2021-25122, CVE-2021-25329

Topics%20covered

Topics Covered

security advisory critical security fix Tomcat Mageia request exposure user session

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Related News

Your message here