CVE-2021-43980

描述

The simplified implementation of blocking reads and writes introduced in Tomcat 10 and back-ported to Tomcat 9.0.47 onwards exposed a long standing (but extremely hard to trigger) concurrency bug in Apache Tomcat 10.1.0 to 10.1.0, 10.0.0 to 10.0.18, 9.0.0 to 9.0.60 and 8.5.0 to 8.5.77 that could cause client connections to share an Http11Processor instance resulting in responses, or part responses, to be received by the wrong client.

如何修補 CVE-2021-43980

要修補 CVE-2021-43980,請將受影響套件升級到下列已修補版本。

• —升級至 8.5.78 或更新版本
• —升級至 9.0.43-2~deb11u4 或更新版本
• —升級至 9.0.31-1~deb10u7 或更新版本
• —升級至 9.0.43-2~deb11u4 或更新版本
• —升級至 8.5.78 或更新版本

CVE-2021-43980 正在被利用嗎?

低 — EPSS 為 1.7%,目前沒有觀察到大規模利用活動。

受影響套件(5)

• >= 8.5.0, < 8.5.78, >= 9.0.0, < 9.0.61, >= 10.0.0, < 10.0.19
• from 0, < 9.0.43-2~deb11u4
• from 0, < 9.0.31-1~deb10u7
• from 0, < 9.0.43-2~deb11u4
• >= 8.5.0, < 8.5.78

CVSS 分數

參考連結(14)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2021-43980
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2021-43980
• PATCHgithub.com/apache/tomcat
• WEBwww.openwall.com/lists/oss-security/2022/09/28/1
• WEB