5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
0.922 High
EPSS
Percentile
99.0%
Issue Overview:
A deserialization flaw was discovered in Apache Tomcat’s use of a FileStore. Under specific circumstances, an attacker can use a specially crafted request to trigger Remote Code Execution through deserialization of the file under their control. The highest threat from the vulnerability is to data confidentiality and integrity as well as system availability. (CVE-2020-9484)
The fix for CVE-2020-9484 was incomplete. When using Apache Tomcat 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41, 8.5.0 to 8.5.61 or 7.0.0. to 7.0.107 with a configuration edge case that was highly unlikely to be used, the Tomcat instance was still vulnerable to CVE-2020-9494. Note that both the previously published prerequisites for CVE-2020-9484 and the previously published mitigations for CVE-2020-9484 also apply to this issue. (CVE-2021-25329)
Affected Packages:
tomcat7
Issue Correction:
Run yum update tomcat7 to update your system.
New Packages:
noarch:
tomcat7-webapps-7.0.108-1.40.amzn1.noarch
tomcat7-log4j-7.0.108-1.40.amzn1.noarch
tomcat7-el-2.2-api-7.0.108-1.40.amzn1.noarch
tomcat7-javadoc-7.0.108-1.40.amzn1.noarch
tomcat7-lib-7.0.108-1.40.amzn1.noarch
tomcat7-admin-webapps-7.0.108-1.40.amzn1.noarch
tomcat7-7.0.108-1.40.amzn1.noarch
tomcat7-servlet-3.0-api-7.0.108-1.40.amzn1.noarch
tomcat7-jsp-2.2-api-7.0.108-1.40.amzn1.noarch
tomcat7-docs-webapp-7.0.108-1.40.amzn1.noarch
src:
tomcat7-7.0.108-1.40.amzn1.src
Red Hat: CVE-2020-9484, CVE-2021-25329
Mitre: CVE-2020-9484, CVE-2021-25329
5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
0.922 High
EPSS
Percentile
99.0%