CVE-2021-30639

Published Jul 12, 2021

Last updated a year ago

CVSS high 7.5

Overview

Description: A vulnerability in Apache Tomcat allows an attacker to remotely trigger a denial of service. An error introduced as part of a change to improve error handling during non-blocking I/O meant that the error flag associated with the Request object was not reset between requests. This meant that once a non-blocking I/O error occurred, all future requests handled by that request object would fail. Users were able to trigger non-blocking I/O errors, e.g. by dropping a connection, thereby creating the possibility of triggering a DoS. Applications that do not use non-blocking I/O are not exposed to this vulnerability. This issue affects Apache Tomcat 10.0.3 to 10.0.4; 9.0.44; 8.5.64.
Source: security@apache.org
NVD status: Modified

Risk scores

CVSS 3.1

Type: Primary
Base score: 7.5
Impact score: 3.6
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Severity: HIGH

CVSS 2.0

Type: Primary
Base score: 5
Impact score: 2.9
Exploitability score: 10
Vector string: AV:N/AC:L/Au:N/C:N/I:N/A:P

Weaknesses

nvd@nist.gov: CWE-755

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:apache:tomcat:8.5.64:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "957579EB-9220-4E0F-AAA7-8C3508F1B324"
          },
          {
            "criteria": "cpe:2.3:a:apache:tomcat:9.0.44:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "EFF4A0C3-65AA-4B29-A5F7-343478672608"
          },
          {
            "criteria": "cpe:2.3:a:apache:tomcat:10.0.3:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "7F002FE3-E742-465B-97A3-D0A530E712C0"
          },
          {
            "criteria": "cpe:2.3:a:apache:tomcat:10.0.4:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "1CD1CF8D-350B-4C2D-B801-2FD780890340"
          }
        ],
        "operator": "OR"
      }
    ]
  },
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "A30F7908-5AF6-4761-BC6A-4C18EFAE48E5",
            "versionEndExcluding": "5.10.0"
          },
          {
            "criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:-:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "0F30D3AF-4FA3-4B7A-BE04-C24E2EA19A95"
          },
          {
            "criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_1:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "7B00DDE7-7002-45BE-8EDE-65D964922CB0"
          },
          {
            "criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_10:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "DB88C165-BB24-49FB-AAF6-087A766D5AD1"
          },
          {
            "criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_2:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "FF806B52-DAD5-4D12-8BB6-3CBF9DC6B8DF"
          },
          {
            "criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_3:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "7DE847E0-431D-497D-9C57-C4E59749F6A0"
          },
          {
            "criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_4:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "46385384-5561-40AA-9FDE-A2DE4FDFAD3E"
          },
          {
            "criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_5:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "B7CA7CA6-7CF2-48F6-81B5-69BA0A37EF4E"
          },
          {
            "criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_6:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "9E4E5481-1070-4E1F-8679-1985DE4E785A"
          },
          {
            "criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_7:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "D9EEA681-67FF-43B3-8610-0FA17FD279E5"
          },
          {
            "criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_8:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "C33BA8EA-793D-4E79-BE9C-235ACE717216"
          },
          {
            "criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_9:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "823DBE80-CB8D-4981-AE7C-28F3FDD40451"
          }
        ],
        "operator": "OR"
      }
    ]
  },
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:oracle:big_data_spatial_and_graph:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "384DEDD9-CB26-4306-99D8-83068A9B23ED",
            "versionEndExcluding": "23.1"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

Overview

Risk scores

CVSS 3.1

CVSS 2.0

Weaknesses

Social media

Configurations

References