CVE-2021-25122 Apache Tomcat h2c request mix-up
Apache Tomcat may leak request headers and body data between users during h2c connection handling, allowing one user to see another's request details.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-25122?
CVE-2021-25122 is a high-severity vulnerability in Apache Tomcat, published on 1 Mar 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
When responding to new h2c connection requests, Apache Tomcat versions 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41 and 8.5.0 to 8.5.61 could duplicate request headers and a limited amount of request body from one request to another meaning user A and user B could both see the results of user A's request.
Weakness: CWE-200
Which versions are affected by CVE-2021-25122?
9 open source packages ship an affected version, including org.apache.tomcat.embed:tomcat-embed-core, tomcat and org.apache.tomcat:tomcat-coyote. It affects 12 products.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.tomcat.embed:tomcat-embed-core Maven | From 10.0.0-M1 | 10.0.2 |
org.apache.tomcat.embed:tomcat-embed-core Maven | From 10.0.0-M1 | 10.0.2 |
org.apache.tomcat.embed:tomcat-embed-core Maven | From 8.5.0 | 8.5.63 |
org.apache.tomcat.embed:tomcat-embed-core Maven | From 8.5.0 | 8.5.63 |
org.apache.tomcat.embed:tomcat-embed-core Maven | From 9.0.0-M1 | 9.0.43 |
org.apache.tomcat.embed:tomcat-embed-core Maven | From 9.0.0-M1 | 9.0.43 |
3 more packages
tomcat Bitnami | From 8.5.0 | 8.5.62, 9.0.42, 10.0.1 |
org.apache.tomcat:tomcat-coyote Maven | From 10.0.0-M1 | 10.0.2 |
org.apache.tomcat:tomcat-coyote Maven | From 10.0.0-M1 | 10.0.2 |
Products include Apache Tomcat, Debian Debian Linux, Oracle Agile Product Lifecycle Management, Oracle Communications Cloud Native Core Policy, Oracle Communications Cloud Native Core Security Edge Protection Proxy, Oracle Communications Instant Messaging Server and 6 more.
How do I fix CVE-2021-25122?
Upgrade org.apache.tomcat.embed:tomcat-embed-core to a fixed version for your release line: 10.0.2, 8.5.63 or 9.0.43.
Is CVE-2021-25122 being exploited?
There is no known exploitation of CVE-2021-25122 in the wild and no public exploit code.
Other vulnerabilities in Apache Tomcat
Sources
Also known as BIT-tomcat-2021-25122, DEBIAN-CVE-2021-25122, GHSA-j39c-c8hj-x4j3, ROOT-APP-MAVEN-CVE-2021-25122, UBUNTU-CVE-2021-25122.