CVE-2021-42340
First published: Thu Oct 14 2021(Updated: )
Apache Tomcat is vulnerable to a denial of service, caused by a memory leak flaw in WebSocket connections. By sending a specially-crafted request using OutOfMemoryError, a remote attacker could exploit this vulnerability to cause a denial of service condition.
Credit: security@apache.org security@apache.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/pki-servlet-engine | <1:9.0.50-1.el9 | 1:9.0.50-1.el9 |
| redhat/jws5-tomcat | <0:9.0.50-3.redhat_00004.1.el7 | 0:9.0.50-3.redhat_00004.1.el7 |
| redhat/jws5-tomcat-native | <0:1.2.30-3.redhat_3.el7 | 0:1.2.30-3.redhat_3.el7 |
| redhat/jws5-tomcat-vault | <0:1.1.8-4.Final_redhat_00004.1.el7 | 0:1.1.8-4.Final_redhat_00004.1.el7 |
| redhat/jws5-tomcat | <0:9.0.50-3.redhat_00004.1.el8 | 0:9.0.50-3.redhat_00004.1.el8 |
| redhat/jws5-tomcat-native | <0:1.2.30-3.redhat_3.el8 | 0:1.2.30-3.redhat_3.el8 |
| redhat/jws5-tomcat-vault | <0:1.1.8-4.Final_redhat_00004.1.el8 | 0:1.1.8-4.Final_redhat_00004.1.el8 |
| debian/tomcat9 | 9.0.31-1~deb10u6 9.0.31-1~deb10u10 9.0.43-2~deb11u6 9.0.43-2~deb11u9 9.0.70-2 | |
| maven/org.apache.tomcat:tomcat | >=8.5.60<8.5.72 | 8.5.72 |
| maven/org.apache.tomcat:tomcat | >=9.0.40<9.0.54 | 9.0.54 |
| maven/org.apache.tomcat:tomcat | >=10.0.0-M1<10.0.12 | 10.0.12 |
| maven/org.apache.tomcat:tomcat | >=10.1.0-M1<=10.1.0-M5 | 10.1.0-M6 |
| redhat/tomcat | <10.1.0 | 10.1.0 |
| redhat/tomcat | <10.0.12 | 10.0.12 |
| redhat/tomcat | <9.0.54 | 9.0.54 |
| redhat/tomcat | <8.5.72 | 8.5.72 |
| Apache Tomcat | >=8.5.60<8.5.72 | |
| Apache Tomcat | >=9.0.40<9.0.54 | |
| Apache Tomcat | >=10.0.1<10.0.12 | |
| Apache Tomcat | =10.0.0-milestone10 | |
| Apache Tomcat | =10.1.0-milestone1 | |
| Apache Tomcat | =10.1.0-milestone2 | |
| Apache Tomcat | =10.1.0-milestone3 | |
| Apache Tomcat | =10.1.0-milestone4 | |
| Apache Tomcat | =10.1.0-milestone5 | |
| Netapp Hci | ||
| Netapp Management Services For Element Software | ||
| Debian Debian Linux | =11.0 | |
| Oracle Agile Engineering Data Management | =6.2.1.0 | |
| Oracle Big Data Spatial And Graph | <23.1 | |
| Oracle Communications Diameter Signaling Router | >=8.0.0.0<=8.5.0.2 | |
| Oracle Hospitality Cruise Shipboard Property Management System | =20.1.0 | |
| Oracle Managed File Transfer | =12.2.1.3.0 | |
| Oracle Managed File Transfer | =12.2.1.4.0 | |
| Oracle Middleware Common Libraries And Tools | =12.2.1.4.0 | |
| Oracle Payment Interface | =19.1 | |
| Oracle Payment Interface | =20.3 | |
| Oracle Retail Customer Insights | =15.0.2 | |
| Oracle Retail Customer Insights | =16.0.2 | |
| Oracle Retail Data Extractor For Merchandising | =15.0.2 | |
| Oracle Retail Data Extractor For Merchandising | =16.0.2 | |
| Oracle Retail Eftlink | =21.0.0 | |
| Oracle Retail Financial Integration | =16.0.1 | |
| Oracle Retail Financial Integration | =19.0.0 | |
| Oracle Retail Store Inventory Management | =14.0.4.13 | |
| Oracle Retail Store Inventory Management | =14.1.3.5 | |
| Oracle Retail Store Inventory Management | =14.1.3.14 | |
| Oracle Retail Store Inventory Management | =15.0.3.3 | |
| Oracle Retail Store Inventory Management | =15.0.3.8 | |
| Oracle Retail Store Inventory Management | =16.0.3.7 | |
| Oracle SD-WAN Edge | =9.0 | |
| Oracle SD-WAN Edge | =9.1 | |
| Oracle Taleo Platform |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.cve.org/CVERecord?id=CVE-2021-42340 https://nvd.nist.gov/vuln/detail/CVE-2021-42340 http://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.0.12 http://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.0-M6 http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.72 http://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.54 https://lists.apache.org/thread.html/r83a35be60f06aca2065f188ee542b9099695d57ced2e70e0885f905c%40%3Cannounce.tomcat.apache.org%3E
- https://bugzilla.redhat.com/show_bug.cgi?id=2014356
- https://access.redhat.com/errata/RHBA-2022:8077
- https://access.redhat.com/errata/RHSA-2022:5532
- https://access.redhat.com/errata/RHSA-2021:4863
- https://access.redhat.com/errata/RHSA-2021:4861
- https://access.redhat.com/errata/RHSA-2022:1179
- https://access.redhat.com/security/cve/cve-2021-42340
- https://www.openwall.com/lists/oss-security/2021/10/14/1
- https://github.com/apache/tomcat/commit/80f1438ec45e77a07b96419808971838d259eb47
- https://github.com/apache/tomcat/commit/d27535bdee95d252418201eb21e9d29476aa6b6a
- https://bz.apache.org/bugzilla/show_bug.cgi?id=63362
- https://security-tracker.debian.org/tracker/CVE-2021-42340
- https://kc.mcafee.com/corporate/index?page=content&id=SB10379
- https://lists.apache.org/thread.html/r8097a2d1550aa78e585fc77e602b9046e6d4099d8d132497c5387784@%3Ccommits.myfaces.apache.org%3E
- https://lists.apache.org/thread.html/r83a35be60f06aca2065f188ee542b9099695d57ced2e70e0885f905c%40%3Cannounce.tomcat.apache.org%3E
- https://security.gentoo.org/glsa/202208-34
- https://security.netapp.com/advisory/ntap-20211104-0001/
- https://www.debian.org/security/2021/dsa-5009
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://nvd.nist.gov/vuln/detail/CVE-2021-42340
- https://github.com/apache/tomcat/commit/31d62426645824bdfe076a0c0eafa904d90b4fb9
- https://github.com/apache/tomcat/commit/d5a6660cba7f51589468937bf3bbad4db7810371
- https://tomcat.apache.org/security-9.html
- https://tomcat.apache.org/security-8.html
- https://tomcat.apache.org/security-10.html
- https://security.netapp.com/advisory/ntap-20211104-0001
- https://github.com/advisories/GHSA-wph7-x527-w3h5 (Advisory)
- https://access.redhat.com/support/policy/updates/jboss_notes
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2014926
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2014927
- https://lists.apache.org/thread.html/r8097a2d1550aa78e585fc77e602b9046e6d4099d8d132497c5387784%40%3Ccommits.myfaces.apache.org%3E
- https://exchange.xforce.ibmcloud.com/vulnerabilities/211354
- https://www.ibm.com/support/pages/node/7144861 (Advisory)
Parent vulnerabilities
(Appears in the following advisories)
Frequently Asked Questions
What is CVE-2021-42340?
CVE-2021-42340 is a vulnerability in Apache Tomcat that allows for a denial of service attack caused by a memory leak flaw in WebSocket connections.
What is the severity of CVE-2021-42340?
CVE-2021-42340 has a severity level of high.
Which versions of Apache Tomcat are affected by CVE-2021-42340?
Apache Tomcat versions 10.1.0-M1 to 10.1.0-M5, 10.0.0-M1 to 10.0.11, 9.0.40 to 9.0.53, and 8.5.60 to 8.5.71 are affected by CVE-2021-42340.
What is the fix for CVE-2021-42340?
The fix for CVE-2021-42340 is available in Apache Tomcat 10.1.0-M6, 10.0.12, 9.0.54, and 8.5.72.
How can I mitigate the vulnerability?
To mitigate the vulnerability, it is recommended to update Apache Tomcat to versions 10.1.0-M6, 10.0.12, 9.0.54, or 8.5.72.
- collector/redhat-cve
- collector/security-tracker-debian
- agent/type
- agent/first-publish-date
- agent/remedy
- agent/severity
- agent/weakness
- agent/description
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-wph7-x527-w3h5
- alias/CVE-2021-42340
- agent/software-canonical-lookup
- collector/redhat-bugzilla
- source/Red Hat
- agent/author
- collector/github-advisory
- collector/ibm-support
- source/IBM
- agent/last-modified-date
- agent/references
- agent/event
- agent/softwarecombine
- agent/tags
- collector/nvd-cve
- source/NVD
- agent/software-canonical-lookup-request
- collector/nvd-index
- package-manager/redhat
- package-manager/debian
- package-manager/maven
- vendor/apache
- canonical/apache tomcat
- version/apache tomcat/8.5.60
- version/apache tomcat/9.0.40
- version/apache tomcat/10.0.1
- version/apache tomcat/10.0.0-milestone10
- version/apache tomcat/10.1.0-milestone1
- version/apache tomcat/10.1.0-milestone2
- version/apache tomcat/10.1.0-milestone3
- version/apache tomcat/10.1.0-milestone4
- version/apache tomcat/10.1.0-milestone5
- vendor/netapp
- canonical/netapp hci
- canonical/netapp management services for element software
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/11.0
- vendor/oracle
- canonical/oracle agile engineering data management
- version/oracle agile engineering data management/6.2.1.0
- canonical/oracle big data spatial and graph
- canonical/oracle communications diameter signaling router
- version/oracle communications diameter signaling router/8.0.0.0
- version/oracle communications diameter signaling router/8.5.0.2
- canonical/oracle hospitality cruise shipboard property management system
- version/oracle hospitality cruise shipboard property management system/20.1.0
- canonical/oracle managed file transfer
- version/oracle managed file transfer/12.2.1.3.0
- version/oracle managed file transfer/12.2.1.4.0
- canonical/oracle middleware common libraries and tools
- version/oracle middleware common libraries and tools/12.2.1.4.0
- canonical/oracle payment interface
- version/oracle payment interface/19.1
- version/oracle payment interface/20.3
- canonical/oracle retail customer insights
- version/oracle retail customer insights/15.0.2
- version/oracle retail customer insights/16.0.2
- canonical/oracle retail data extractor for merchandising
- version/oracle retail data extractor for merchandising/15.0.2
- version/oracle retail data extractor for merchandising/16.0.2
- canonical/oracle retail eftlink
- version/oracle retail eftlink/21.0.0
- canonical/oracle retail financial integration
- version/oracle retail financial integration/16.0.1
- version/oracle retail financial integration/19.0.0
- canonical/oracle retail store inventory management
- version/oracle retail store inventory management/14.0.4.13
- version/oracle retail store inventory management/14.1.3.5
- version/oracle retail store inventory management/14.1.3.14
- version/oracle retail store inventory management/15.0.3.3
- version/oracle retail store inventory management/15.0.3.8
- version/oracle retail store inventory management/16.0.3.7
- canonical/oracle sd-wan edge
- version/oracle sd-wan edge/9.0
- version/oracle sd-wan edge/9.1
- canonical/oracle taleo platform