Lucene search
Debian Security Bug TrackerDEBIANCVE:CVE-2021-25329HistoryMar 01, 2021 - 12:15 p.m.
CVE-2021-25329
2021-03-0112:15:14
Debian Security Bug Tracker
security-tracker.debian.org
27
apache tomcat
incomplete fix
vulnerability
configuration edge case
prerequisites
mitigations
unix
CVSS2
5
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
CVSS3
7.5
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS
0.914
Percentile
99.0%
The fix for CVE-2020-9484 was incomplete. When using Apache Tomcat 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41, 8.5.0 to 8.5.61 or 7.0.0. to 7.0.107 with a configuration edge case that was highly unlikely to be used, the Tomcat instance was still vulnerable to CVE-2020-9494. Note that both the previously published prerequisites for CVE-2020-9484 and the previously published mitigations for CVE-2020-9484 also apply to this issue.
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| Debian | 12 | all | tomcat9 | < 9.0.43-1 | tomcat9_9.0.43-1_all.deb |
| Debian | 11 | all | tomcat9 | < 9.0.43-1 | tomcat9_9.0.43-1_all.deb |
| Debian | 999 | all | tomcat9 | < 9.0.43-1 | tomcat9_9.0.43-1_all.deb |
| Debian | 13 | all | tomcat9 | < 9.0.43-1 | tomcat9_9.0.43-1_all.deb |
Related
osv
osv
Potential remote code execution in Apache Tomcat
2021-03-19 20:11:13
BIT-tomcat-2021-25329
2024-03-06 11:10:17
tomcat vulnerabilities
2024-07-23 14:03:15
cvelist
cvelist
CVE-2021-25329 Incomplete fix for CVE-2020-9484
2021-03-01 12:00:20
CVE-2020-9494
2020-06-24 15:25:57
CVE-2020-9484
2020-05-20 18:26:41
github
github
Potential remote code execution in Apache Tomcat
2021-03-19 20:11:13
Potential remote code execution in Apache Tomcat
2020-05-21 18:52:29
nvd
nvd
nessus
nessus
Amazon Linux AMI : tomcat7 (ALAS-2021-1493)
2021-04-07 00:00:00
Apache Tomcat 7.0.0 < 7.0.108 multiple vulnerabilities
2021-03-05 00:00:00
Apache Tomcat 9.0.0.M1 < 9.0.43 multiple vulnerabilities
2021-03-05 00:00:00
redhatcve
redhatcve
CVE-2021-25329
2021-03-02 12:32:45
CVE-2020-9484
2020-05-20 23:25:22
f5
f5
K73648110 : Apache Tomcat vulnerability CVE-2021-25329
2021-03-16 00:00:00
K03121171 : Apache Tomcat vulnerability CVE-2020-9484
2020-05-27 00:00:00
amazon
amazon
Low: tomcat7
2021-04-07 00:18:00
Important: tomcat7
2020-06-23 06:45:00
Important: tomcat8
2020-06-23 06:47:00
prion
prion
Design/Logic Flaw
2021-03-01 12:15:00
Design/Logic Flaw
2020-06-24 16:15:00
Deserialization of untrusted data
2020-05-20 19:15:00
ubuntucve
ubuntucve
cve
cve
openvas
openvas
Mageia: Security Advisory (MGASA-2021-0357)
2022-01-28 00:00:00
Huawei EulerOS: Security Advisory for tomcat (EulerOS-SA-2021-1891)
2021-05-19 00:00:00
Huawei EulerOS: Security Advisory for tomcat (EulerOS-SA-2021-2435)
2021-09-15 00:00:00
mageia
mageia
Updated tomcat packages fix security vulnerabilities
2021-07-20 13:46:47
Updated tomcat packages fix security vulnerability
2020-07-05 14:26:44
veracode
veracode
Remote Code Execution
2021-03-03 06:05:38
Remote Code Execution (RCE)
2021-03-02 07:51:38
Remote Code Execution
2020-05-21 03:52:01
tomcat
tomcat
Fixed in Apache Tomcat 7.0.108
2021-02-05 00:00:00
Fixed in Apache Tomcat 10.0.2
2021-02-02 00:00:00
Fixed in Apache Tomcat 9.0.43
2021-02-02 00:00:00
attackerkb
attackerkb
CVE-2020-9484 — PersistentManager Java deserialization vulnerability
2020-05-20 00:00:00
debian
debian
[SECURITY] [DLA 2596-1] tomcat8 security update
2021-03-16 05:29:03
[SECURITY] [DSA 4710-1] trafficserver security update
2020-06-27 17:38:29
[SECURITY] [DLA 2217-1] tomcat7 security update
2020-05-23 17:27:59
ubuntu
ubuntu
Tomcat vulnerabilities
2024-07-23 00:00:00
suse
suse
Security update for tomcat (important)
2021-04-02 00:00:00
Security update for tomcat (important)
2020-05-25 00:00:00
redhat
redhat
(RHSA-2021:2562) Moderate: Red Hat JBoss Web Server 5.5.0 security release
2021-06-29 08:35:57
(RHSA-2021:2561) Moderate: Red Hat JBoss Web Server 5.5.0 Security release
2021-06-29 08:34:12
(RHSA-2020:2509) Important: Red Hat JBoss Web Server 5.3.1 security update
2020-06-10 17:01:08
rosalinux
rosalinux
Advisory ROSA-SA-2021-1988
2021-07-02 18:17:52
debiancve
debiancve
CVE-2020-9494
2020-06-24 16:15:11
CVE-2020-9484
2020-05-20 19:15:09
kaspersky
kaspersky
KLA12105 ACE vulnerability in Apache Tomcat
2021-02-05 00:00:00
KLA11785 Security vulnerability in Apache Tomcat
2020-05-11 00:00:00
KLA11784 Security vulnerability in Apache Tomcat
2020-05-16 00:00:00
cgr
cgr
CVE-2021-25329 vulnerabilities
2024-05-19 03:07:16
freebsd
freebsd
trafficserver -- resource consumption
2020-06-24 00:00:00
Apache Tomcat Remote Code Execution via session persistence
2020-05-12 00:00:00
gentoo
gentoo
Apache Tomcat: Remote code execution
2020-06-15 00:00:00
atlassian
atlassian
Upgrade Apache Tomcat 8.5.50 - version affected by CVE-2020-9484
2020-06-25 04:59:30
Upgrade Apache Tomcat 8.5.50 - version affected by CVE-2020-9484
2020-06-25 04:59:30
8.5 and 8.13 LTS releases should bundle Tomcat 8.5.63 or higher
2021-04-12 15:50:10
ibm
ibm
Security Bulletin: Open Source Apache Tomcat vulnerabilities affect IBM Tivoli Application Dependency Discovery Manager (CVE-2020-9484)
2020-07-24 22:19:08
centos
centos
tomcat security update
2020-06-11 21:13:08
archlinux
archlinux
[ASA-202006-5] tomcat8: arbitrary code execution
2020-06-06 00:00:00
[ASA-202006-7] tomcat9: arbitrary code execution
2020-06-06 00:00:00
[ASA-202006-6] tomcat7: arbitrary code execution
2020-06-06 00:00:00
githubexploit
githubexploit
Exploit for Deserialization of Untrusted Data in Apache Tomcat
2020-09-05 13:56:51
Exploit for Deserialization of Untrusted Data in Apache Tomcat
2021-01-26 22:51:30
Exploit for Deserialization of Untrusted Data in Oracle Retail Order Broker
2021-01-15 17:59:50
oraclelinux
oraclelinux
tomcat security update
2020-06-11 00:00:00
tomcat6 security update
2020-06-12 00:00:00
fedora
fedora
[SECURITY] Fedora 31 Update: tomcat-9.0.36-1.fc31
2020-06-23 01:14:05
[SECURITY] Fedora 32 Update: tomcat-9.0.36-1.fc32
2020-06-23 01:22:02
broadcom
broadcom
BSA-2022-1839
2022-05-03 00:00:00
nuclei
nuclei
Apache Tomcat Remote Command Execution
2020-07-03 05:39:02
photon
photon
CVSS2
5
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
CVSS3
7.5
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS
0.914
Percentile
99.0%
Related for DEBIANCVE:CVE-2021-25329