CVE-2021-41079 Apache Tomcat DoS with unexpected TLS packet
Attackers can cause a denial of service via infinite loop in Apache Tomcat when using NIO+OpenSSL or NIO2+OpenSSL for TLS.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-41079?
CVE-2021-41079 is a high-severity denial of service vulnerability in Apache Tomcat, published on 16 Sep 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Apache Tomcat 8.5.0 to 8.5.63, 9.0.0-M1 to 9.0.43 and 10.0.0-M1 to 10.0.2 did not properly validate incoming TLS packets. When Tomcat was configured to use NIO+OpenSSL or NIO2+OpenSSL for TLS, a specially crafted packet could be used to trigger an infinite loop resulting in a denial of service.
Which versions are affected by CVE-2021-41079?
7 open source packages ship an affected version, including org.apache.tomcat:tomcat and tomcat. It affects 3 products.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.tomcat:tomcat Maven | From 10.0.0 | 10.0.4 |
org.apache.tomcat:tomcat Maven | From 10.0.0 | 10.0.4 |
org.apache.tomcat:tomcat Maven | From 8.5.0 | 8.5.64 |
org.apache.tomcat:tomcat Maven | From 8.5.0 | 8.5.64 |
org.apache.tomcat:tomcat Maven | From 9.0.0 | 9.0.44 |
org.apache.tomcat:tomcat Maven | From 9.0.0 | 9.0.44 |
1 more packages
tomcat Bitnami | From 8.5.0 | 8.5.64, 9.0.44, 10.0.3 |
Linux distribution packages (22)
jws5-tomcat Red Hat:jboss_enterprise_web_server:5.5::el7 | All versions | 0:9.0.43-13.redhat_00013.1.el7jws |
jws5-tomcat-admin-webapps Red Hat:jboss_enterprise_web_server:5.5::el7 | All versions | 0:9.0.43-13.redhat_00013.1.el7jws |
jws5-tomcat-docs-webapp Red Hat:jboss_enterprise_web_server:5.5::el7 | All versions | 0:9.0.43-13.redhat_00013.1.el7jws |
jws5-tomcat-el-3.0-api Red Hat:jboss_enterprise_web_server:5.5::el7 | All versions | 0:9.0.43-13.redhat_00013.1.el7jws |
jws5-tomcat-java-jdk11 Red Hat:jboss_enterprise_web_server:5.5::el7 | All versions | 0:9.0.43-13.redhat_00013.1.el7jws |
jws5-tomcat-java-jdk8 Red Hat:jboss_enterprise_web_server:5.5::el7 | All versions | 0:9.0.43-13.redhat_00013.1.el7jws |
jws5-tomcat-javadoc Red Hat:jboss_enterprise_web_server:5.5::el7 | All versions | 0:9.0.43-13.redhat_00013.1.el7jws |
jws5-tomcat-jsp-2.3-api Red Hat:jboss_enterprise_web_server:5.5::el7 | All versions | 0:9.0.43-13.redhat_00013.1.el7jws |
jws5-tomcat-lib Red Hat:jboss_enterprise_web_server:5.5::el7 | All versions | 0:9.0.43-13.redhat_00013.1.el7jws |
jws5-tomcat-selinux Red Hat:jboss_enterprise_web_server:5.5::el7 | All versions | 0:9.0.43-13.redhat_00013.1.el7jws |
jws5-tomcat-servlet-4.0-api Red Hat:jboss_enterprise_web_server:5.5::el7 | All versions | 0:9.0.43-13.redhat_00013.1.el7jws |
jws5-tomcat-webapps Red Hat:jboss_enterprise_web_server:5.5::el7 | All versions | 0:9.0.43-13.redhat_00013.1.el7jws |
jws5-tomcat Red Hat:jboss_enterprise_web_server:5.5::el8 | All versions | 0:9.0.43-13.redhat_00013.1.el8jws |
jws5-tomcat-admin-webapps Red Hat:jboss_enterprise_web_server:5.5::el8 | All versions | 0:9.0.43-13.redhat_00013.1.el8jws |
jws5-tomcat-docs-webapp Red Hat:jboss_enterprise_web_server:5.5::el8 | All versions | 0:9.0.43-13.redhat_00013.1.el8jws |
jws5-tomcat-el-3.0-api Red Hat:jboss_enterprise_web_server:5.5::el8 | All versions | 0:9.0.43-13.redhat_00013.1.el8jws |
jws5-tomcat-javadoc Red Hat:jboss_enterprise_web_server:5.5::el8 | All versions | 0:9.0.43-13.redhat_00013.1.el8jws |
jws5-tomcat-jsp-2.3-api Red Hat:jboss_enterprise_web_server:5.5::el8 | All versions | 0:9.0.43-13.redhat_00013.1.el8jws |
jws5-tomcat-lib Red Hat:jboss_enterprise_web_server:5.5::el8 | All versions | 0:9.0.43-13.redhat_00013.1.el8jws |
jws5-tomcat-selinux Red Hat:jboss_enterprise_web_server:5.5::el8 | All versions | 0:9.0.43-13.redhat_00013.1.el8jws |
jws5-tomcat-servlet-4.0-api Red Hat:jboss_enterprise_web_server:5.5::el8 | All versions | 0:9.0.43-13.redhat_00013.1.el8jws |
jws5-tomcat-webapps Red Hat:jboss_enterprise_web_server:5.5::el8 | All versions | 0:9.0.43-13.redhat_00013.1.el8jws |
Products include Apache Tomcat, Debian Debian Linux, Netapp Management Services for Element Software and Netapp Hci.
How do I fix CVE-2021-41079?
Upgrade org.apache.tomcat:tomcat to a fixed version for your release line: 10.0.4, 8.5.64 or 9.0.44.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2021-41079 being exploited?
There is no known exploitation of CVE-2021-41079 in the wild and no public exploit code.
Other vulnerabilities in Apache Tomcat
Sources
Also known as BIT-tomcat-2021-41079, DEBIAN-CVE-2021-41079, DLA-2764-1, DSA-4986-1, GHSA-59g9-7gfx-c72p, OESA-2021-1393 and 3 more.