CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:N/A:N
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS
Percentile
99.0%
Issue Overview:
A deserialization flaw was discovered in Apache Tomcat’s use of a FileStore. Under specific circumstances, an attacker can use a specially crafted request to trigger Remote Code Execution through deserialization of the file under their control. The highest threat from the vulnerability is to data confidentiality and integrity as well as system availability. (CVE-2020-9484)
When responding to new h2c connection requests, Apache Tomcat versions 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41 and 8.5.0 to 8.5.61 could duplicate request headers and a limited amount of request body from one request to another meaning user A and user B could both see the results of user A’s request. (CVE-2021-25122)
Affected Packages:
tomcat8
Issue Correction:
Run yum update tomcat8 to update your system.
New Packages:
noarch:
tomcat8-log4j-8.5.63-1.87.amzn1.noarch
tomcat8-jsp-2.3-api-8.5.63-1.87.amzn1.noarch
tomcat8-servlet-3.1-api-8.5.63-1.87.amzn1.noarch
tomcat8-admin-webapps-8.5.63-1.87.amzn1.noarch
tomcat8-webapps-8.5.63-1.87.amzn1.noarch
tomcat8-el-3.0-api-8.5.63-1.87.amzn1.noarch
tomcat8-javadoc-8.5.63-1.87.amzn1.noarch
tomcat8-docs-webapp-8.5.63-1.87.amzn1.noarch
tomcat8-8.5.63-1.87.amzn1.noarch
tomcat8-lib-8.5.63-1.87.amzn1.noarch
src:
tomcat8-8.5.63-1.87.amzn1.src
Red Hat: CVE-2020-9484, CVE-2021-25122
Mitre: CVE-2020-9484, CVE-2021-25122
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:N/A:N
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS
Percentile
99.0%