CVE-2021-25329

The fix for CVE-2020-9484 was incomplete. When using Apache Tomcat 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41, 8.5.0 to 8.5.61 or 7.0.0. to 7.0.107 with a configuration edge case that was highly unlikely to be used, the Tomcat instance was still vulnerable to CVE-2020-9494. Note that both the previously published prerequisites for CVE-2020-9484 and the previously published mitigations for CVE-2020-9484 also apply to this issue.

The Apache Tomcat software is developed in an open and participatory environment and released under the Apache License version 2. The Apache Tomcat project is intended to be a collaboration of the best-of-breed developers from around the world. We invite you to participate in this open development project

Security Fix(es):

The fix for CVE-2020-9484 was incomplete. When using Apache Tomcat 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41, 8.5.0 to 8.5.61 or 7.0.0. to 7.0.107 with a configuration edge case that was highly unlikely to be used, the Tomcat instance was still vulnerable to CVE-2020-9494. Note that both the previously published prerequisites for CVE-2020-9484 and the previously published mitigations for CVE-2020-9484 also apply to this issue.(CVE-2021-25329)

When responding to new h2c connection requests, Apache Tomcat versions 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41 and 8.5.0 to 8.5.61 could duplicate request headers and a limited amount of request body from one request to another meaning user A and user B could both see the results of user A's request.(CVE-2021-25122)

The fix for CVE-2020-9484 was incomplete. When using Apache Tomcat 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41, 8.5.0 to 8.5.61 or 7.0.0. to 7.0.107 with a configuration edge case that was highly unlikely to be used, the Tomcat instance was still vulnerable to CVE-2020-9494. Note that both the previously published prerequisites for CVE-2020-9484 and the previously published mitigations for CVE-2020-9484 also apply to this issue.

The fix for CVE-2020-9484 was incomplete. When using Apache Tomcat 10.0.0 to 10.0.0, 9.0.0 to 9.0.41, 8.5.0 to 8.5.61 or 7.0.0. to 7.0.107 with a configuration edge case that was highly unlikely to be used, the Tomcat instance was still vulnerable to CVE-2020-9494. Note that both the previously published prerequisites for CVE-2020-9484 and the previously published mitigations for CVE-2020-9484 also apply to this issue.

• Fix build process:
  • debian/keystores/.pem|.jks: update expiring certs and keystores
  • debian/patches/0028-update-expiring-test-certs.patch: update expiring test certs
  • debian/patches/0029-fix-path-to-valid-keystore.patch: fix path to valid keystore
  • debian/patches/0030-use-tls12-in-tests.patch: use TLSv1.2 protocol instead of TLSv1 for several tests
• SECURITY UPDATE: AJP Request Injection and potential Remote Code Execution
  • debian/patches/CVE-2020-1938-1.patch: rename requiredSecret to secret and add secretRequired
  • debian/patches/CVE-2020-1938-2.patch: refactor secret check
  • debian/patches/CVE-2020-1938-3.patch: add new AJP attribute allowedArbitraryRequestAttributes
  • debian/patches/CVE-2020-1938-4.patch: change the default bind address for AJP to the loopback address
  • CVE-2020-1938
• SECURITY UPDATE: Remote Code Execution via session persistence
  • debian/patches/CVE-2020-9484.patch: improve validation of storage location when using FileStore
  • CVE-2020-9484
• SECURITY UPDATE: Fix for CVE-2020-9484 was incomplete
  • debian/patches/CVE-2021-25329.patch: use consistent approach for sub-directory checking
  • CVE-2021-25329

• SECURITY UPDATE: Remote Code Execution via session persistence
  • debian/patches/CVE-2020-9484.patch: Improve validation of storage location when using FileStore.
  • CVE-2020-9484
• SECURITY UPDATE: Fix for CVE-2020-9484 was incomplete
  • debian/patches/CVE-2021-25329-pre1.patch: Fix some edge cases where the docBase was not being set using a canonical path which in turn meant resource URLs were not being constructed as expected.
  • debian/patches/CVE-2021-25329.patch: Use java.nio.file.Path for consistent sub-directory checking.
  • CVE-2021-25329
• SECURITY UPDATE: Local Privilege Escalation
  • debian/patches/CVE-2022-23181.patch: Make calculation of session storage location more robust.
  • CVE-2022-23181
• Update the expired test certificates:
  • debian/test_certs/.pem|.jks: Take the last test certificates from the upstream branch 8.5.x.
  • debian/source/include-binaries: Specifying the binary *.jks files to prevent build failures.
  • debian/rules: Before the testing stage, the old certificates in the source code are replaced with the new ones from debian/test_certs.

• CVE-2021-25329: use consistent approach for sub-directory checking
• Fix javadoc build

• Fix file path bug introduced by the CVE-2021-25329 fix

• SECURITY UPDATE: still vulnerable to CVE-2020-9484 with a configuration edge case
  • debian/patches/CVE-2021-25329.patch: use java.nio.file.Path for consistent sub-directory checking
  • CVE-2021-25329
• SECURITY UPDATE: time-of-check to time-of-use vulnerability introduced by the CVE-2020-9484 fix
  • debian/patches/CVE-2022-23181.patch: make calculation of session storage location more robust
  • CVE-2022-23181
• Internal tests:
  • debian/rules: fail the build if some of the tests have failed
  • debian/patches/skipping-tests-incompatible-with-firewall.patch: backport from ubuntu18 els
  • debian/patches/dont-test-unsupported-ciphers.patch: skip testing of unsupported ciphers
  • debian/patches/skip-tests-error-and-unstable.patch: skip tests that fail with error and unstable ones

• SECURITY UPDATE: Misc vulnerability fixes
  • CVE-2019-12418, CVE-2019-17563, CVE-2020-1935, CVE-2020-11996, CVE-2020-13934, CVE-2020-13935, CVE-2020-13943, CVE-2020-17527, CVE-2021-24122, CVE-2021-30639, CVE-2021-30640, CVE-2021-33037, CVE-2021-42340, CVE-2021-43980, CVE-2022-25762, CVE-2022-34305, CVE-2022-45143, CVE-2023-24998, CVE-2023-28709, CVE-2023-34981, CVE-2023-42794, CVE-2024-21733
• Update to 8.5.100
  • debian/rules, debian/libtomcat8-java.poms, debian/maven.rules, debian/tomcat8-common.links, debian/patches/0018-fix-manager-webapp.patch, debian/patches/0019-add-distribution-to-error-page.patch, debian/patches/0021-dont-test-unsupported-ciphers.patch, debian/patches/0101-skipping-tests-incompatible-with-firewall.patch: updated
  • debian/patches/0002-do-not-load-AJP13-connector-by-default.patch, debian/patches/0026-easymock4-compatibility.patch: removed as they were applied in upstream
  • CVE-2019-0221.patch, CVE-2019-10072-1.patch, CVE-2019-10072-2.patch, CVE-2022-42252.patch, CVE-2020-1938.patch, CVE-2021-25122.patch, CVE-2021-41079.patch, CVE-2022-29885.patch, CVE-2020-9484.patch, CVE-2021-25329-pre1.patch, CVE-2021-25329.patch, CVE-2022-23181.patch, CVE-2023-44487.patch, CVE-2023-46589-pre1.patch, CVE-2023-46589-pre2.patch, CVE-2023-46589-pre3.patch, CVE-2023-46589-pre4.patch, CVE-2023-46589.patch: removed because these CVEs were fixed in upstream
• Internal tests
  • debian/test_certs/*: updated from upstream branch 9.0.x, as the 8.0.x certs were expired

TuxCare rebuilt 5 packages to address 6 CVEs. Fixed in 9.0.39-tuxcare.1.

TuxCare rebuilt 4 packages to address 6 CVEs. Fixed in 7.0.70-tuxcare.6.

TuxCare rebuilt 5 packages to address 6 CVEs. Fixed in 9.0.13-tuxcare.4.

When responding to new h2c connection requests, Apache Tomcat versions 9.0.0.M1 to 9.0.41 could duplicate request headers and a limited amount of request body from one request to another meaning user A and user B could both see the results of user A's request (CVE-2021-25122).

The fix for CVE-2020-9484 was incomplete. When using Apache Tomcat 9.0.0.M1 to 9.0.41 with a configuration edge case that was highly unlikely to be used, the Tomcat instance was still vulnerable to CVE-2020-9494 (CVE-2021-25329).

This update for tomcat fixes the following issues:

CVE-2021-25122: Apache Tomcat h2c request mix-up (bsc#1182912) CVE-2021-25329: Complete fix for CVE-2020-9484 (bsc#1182909)

This update was imported from the SUSE:SLE-15-SP2:Update update project.

These are all security issues fixed in the tomcat-9.0.36-8.4 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the tomcat10-10.1.14-1.1 package on the GA media of openSUSE Tumbleweed.

This update for tomcat fixes the following issues:

• CVE-2021-25122: Apache Tomcat h2c request mix-up (bsc#1182912)
• CVE-2021-25329: Complete fix for CVE-2020-9484 (bsc#1182909)

This update for tomcat fixes the following issues:

• Fixed CVEs:
  • CVE-2021-25122: Apache Tomcat h2c request mix-up (bsc#1182912)
  • CVE-2021-25329: Complete fix for CVE-2020-9484 (bsc#1182909)
• Log if file access is blocked due to symlinks: CVE-2021-24122 (bsc#1180947)

This update for tomcat fixes the following issues:

CVE-2021-25122: Apache Tomcat h2c request mix-up (bsc#1182912) CVE-2021-25329: Complete fix for CVE-2020-9484 (bsc#1182909)

This update for tomcat fixes the following issues:

• CVE-2021-24122: Fixed an information disclosure if resources are served from the NTFS file system (bsc#1180947).
• CVE-2021-25122: Apache Tomcat h2c request mix-up (bsc#1182912)
• CVE-2021-25329: Complete fix for CVE-2020-9484 (bsc#1182909)

This update for tomcat fixes the following issues:

• CVE-2021-25329: Complete fix for CVE-2020-9484 (bsc#1182909)

This update for tomcat6 fixes the following issues:

• CVE-2021-25329: Fixed completely CVE-2020-9484 (bsc#1182909).
• CVE-2021-24122: Fixed an information disclosure (bsc#1180947).
• CVE-2017-12617: Fixed a file inclusion vulnerability through a crafted request (bsc#1059554).

This update for tomcat fixes the following issues:

Update to Tomcat 9.0.115:

• CVE-2025-48989: HTTP/2 protocol (including DNS over HTTPS) is vulnerable to 'MadeYouReset' DoS attack (bsc#1243895).
• CVE-2025-52434: race condition on connection close when using the APR/Native connector could lead to a JVM crash (bsc#1246389).
• CVE-2025-53506: uncontrolled resource HTTP/2 client consumption vulnerability (bsc#1246318).
• CVE-2025-66614: client certificate verification bypass due to virtual host mapping (bsc#1258371).
• CVE-2026-24733: improper input validation on HTTP/0.9 requests (bsc#1258385).
• CVE-2023-44487: Rapid reset attack (bsc#1216182).

It was discovered that Tomcat incorrectly performed input verification. A remote attacker could possibly use this issue to intercept sensitive information. (CVE-2020-13943, CVE-2020-17527, CVE-2021-25122, CVE-2021-30640)

It was discovered that Tomcat did not properly deserialize untrusted data. An attacker could possibly use this issue to execute arbitrary code. (CVE-2020-9484, CVE-2021-33037)

It was discovered that Tomcat did not properly validate the input length. An attacker could possibly use this to trigger an infinite loop, resulting in a denial of service. (CVE-2021-25329, CVE-2021-41079)

It was discovered that the Tomcat SSI printenv command echoed user provided data without escaping it. An attacker could possibly use this issue to perform an XSS attack. (CVE-2019-0221)

It was discovered that Tomcat incorrectly handled certain uncommon PersistenceManager with FileStore configurations. A remote attacker could possibly use this issue to execute arbitrary code. (CVE-2020-9484, CVE-2021-25329)