CVE-2021-25329 Incomplete fix for CVE-2020-9484
Incomplete fix for CVE-2020-9484 allows remote code execution via deserialization in Apache Tomcat under specific configuration edge cases.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-25329?
CVE-2021-25329 is a high-severity unsafe deserialization vulnerability in Apache Tomcat, published on 1 Mar 2021. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The fix for CVE-2020-9484 was incomplete. When using Apache Tomcat 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41, 8.5.0 to 8.5.61 or 7.0.0. to 7.0.107 with a configuration edge case that was highly unlikely to be used, the Tomcat instance was still vulnerable to CVE-2020-9494. Note that both the previously published prerequisites for CVE-2020-9484 and the previously published mitigations for CVE-2020-9484 also apply to this issue.
Which versions are affected by CVE-2021-25329?
9 open source packages ship an affected version, including org.apache.tomcat.embed:tomcat-embed-core and tomcat. It affects 12 products.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.tomcat.embed:tomcat-embed-core Maven | From 10.0.0-M1 | 10.0.2 |
org.apache.tomcat.embed:tomcat-embed-core Maven | From 10.0.0-M1 | 10.0.2 |
org.apache.tomcat.embed:tomcat-embed-core Maven | From 7.0.0 | 7.0.108 |
org.apache.tomcat.embed:tomcat-embed-core Maven | From 7.0.0 | 7.0.108 |
org.apache.tomcat.embed:tomcat-embed-core Maven | From 8.0.0 | 8.5.61 |
org.apache.tomcat.embed:tomcat-embed-core Maven | From 8.0.0 | 8.5.61 |
3 more packages
org.apache.tomcat.embed:tomcat-embed-core Maven | From 9.0.0 | 9.0.41 |
org.apache.tomcat.embed:tomcat-embed-core Maven | From 9.0.0 | 9.0.41 |
tomcat Bitnami | From 7.0.0 | 7.0.108, 8.5.62, 9.0.42, 10.0.1 |
Linux distribution packages (7)
tomcat SUSE:HPE Helion OpenStack 8 | All versions | 8.0.53-29.46.1 |
tomcat SUSE:Linux Enterprise Server 12 SP2-BCL | All versions | 8.0.53-29.46.1 |
tomcat SUSE:Linux Enterprise Server 12 SP3-BCL | All versions | 8.0.53-29.46.1 |
tomcat SUSE:Linux Enterprise Server 12 SP3-LTSS | All versions | 8.0.53-29.46.1 |
tomcat SUSE:Linux Enterprise Server for SAP Applications 12 SP3 | All versions | 8.0.53-29.46.1 |
tomcat SUSE:OpenStack Cloud 8 | All versions | 8.0.53-29.46.1 |
tomcat SUSE:OpenStack Cloud Crowbar 8 | All versions | 8.0.53-29.46.1 |
Products include Apache Tomcat, Debian Debian Linux, Oracle Agile Product Lifecycle Management, Oracle Communications Cloud Native Core Policy, Oracle Communications Cloud Native Core Security Edge Protection Proxy, Oracle Communications Instant Messaging Server and 6 more.
How do I fix CVE-2021-25329?
Upgrade org.apache.tomcat.embed:tomcat-embed-core to a fixed version for your release line: 10.0.2, 7.0.108, 8.5.61 or 9.0.41.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2021-25329 being exploited?
There is no known exploitation of CVE-2021-25329 in the wild and no public exploit code.
Other vulnerabilities in Apache Tomcat
Sources
Also known as BIT-tomcat-2021-25329, CLSA-2024-1716916085, CLSA-2024-1723060627, DEBIAN-CVE-2021-25329, GHSA-jgwr-3qm3-26f3, SUSE-SU-2021:1431-1 and 1 more.