NetSight
IP …
high7.0

CVE-2021-25329

Potential remote code execution in Apache Tomcat

Impact

The fix for CVE-2020-9484 was incomplete. When using Apache Tomcat 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41, 8.5.0 to 8.5.61 or 7.0.0. to 7.0.107 with a configuration edge case that was highly unlikely to be used, the Tomcat instance was still vulnerable to CVE-2020-9494. Note that both the previously published prerequisites for CVE-2020-9484 and the previously published mitigations for CVE-2020-9484 also apply to this issue.

Affected packages

EcosystemPackageAffectedFixed in
mavenorg.apache.tomcat.embed:tomcat-embed-core>= 10.0.0-M1, < 10.0.210.0.2

Affected products

VendorProductAffected versions
ApacheTomcat
from 7.0.0 through 7.0.107
from 8.5.0 through 8.5.61
from 9.0.0 through 9.0.41
Versions 9.0.0, 10.0.0
DebianDebian Linux
Versions 9.0, 10.0
OracleAgile Product Lifecycle Management
Versions 9.3.3, 9.3.6
OracleCommunications Cloud Native Core Policy
Version 1.14.0
OracleCommunications Cloud Native Core Security Edge Protection Proxy
Version 1.6.0
OracleCommunications Instant Messaging Server
Version 10.0.1.5.0
OracleDatabase
Versions 12.2.0.1, 19c, 21c
OracleGraph Server And Client
before 21.3.0
OracleInstantis Enterprisetrack
Versions 17.1, 17.2, 17.3
OracleManaged File Transfer
Versions 12.2.1.3.0, 12.2.1.4.0
OracleMysql Enterprise Monitor
through 8.0.23
OracleSiebel Ui Framework
before 21.9
Version 21.9

Weakness classification

CWE-502

References