CVE-2021-43980: Apache Tomcat: Information disclosure
Apache Tomcat could allow a remote attacker to obtain sensitive information, caused by a long standing concurrency flaw in the simplified implementation of blocking reads and writes. By sending a specially-crafted request, an attacker could exploit this vulnerability to obtain Http11Processor instance information, and use this information to launch further attacks against the affected system.
Other sources
The simplified implementation of blocking reads and writes introduced in Tomcat 10 and back-ported to Tomcat 9.0.47 onwards exposed a long standing (but extremely hard to trigger) concurrency bug in Apache Tomcat 10.1.0 to 10.1.0-M12, 10.0.0-M1 to 10.0.18, 9.0.0-M1 to 9.0.60 and 8.5.0 to 8.5.77 that could cause client connections to share an Http11Processor instance resulting in responses, or part responses, to be received by the wrong client.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-43980?
CVE-2021-43980 has a severity rating that indicates a risk of obtaining sensitive information due to a concurrency flaw in Apache Tomcat.
How do I fix CVE-2021-43980?
To fix CVE-2021-43980, upgrade Apache Tomcat to versions 9.0.62, 10.0.20, or 8.5.78 or later.
Which versions of Apache Tomcat are affected by CVE-2021-43980?
CVE-2021-43980 affects Apache Tomcat versions from 8.5.0 to 8.5.77, 9.0.0 to 9.0.60, and 10.0.0 to 10.0.18.
What types of attacks can exploit CVE-2021-43980?
CVE-2021-43980 can be exploited via specially-crafted requests that target the long-standing concurrency flaw in blocking reads and writes.
Is CVE-2021-43980 only a remote vulnerability?
Yes, CVE-2021-43980 enables remote attackers to exploit the vulnerability without requiring local access.