Bugzilla – Bug 1182909
VUL-0: CVE-2021-25329: tomcat,tomcat6: Apache Tomcat Incomplete fix for
Last modified: 2021-09-14 15:45:42 UTC
CVE-2021-25329 The fix for CVE-2020-9484 was incomplete. When using Apache Tomcat 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41, 8.5.0 to 8.5.61 or 7.0.0. to 7.0.107 with a configuration edge case that was highly unlikely to be used, the Tomcat instance was still vulnerable to CVE-2020-9494. Note that both the previously published prerequisites for CVE-2020-9484 and the previously published mitigations for CVE-2020-9484 also apply to this issue. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-25329 http://www.openwall.com/lists/oss-security/2021/03/01/2 http://seclists.org/oss-sec/2021/q1/184 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25329 https://lists.apache.org/thread.html/rfe62fbf9d4c314f166fe8c668e50e5d9dd882a99447f26f0367474bf@%3Cannounce.tomcat.apache.org%3E https://lists.apache.org/thread.html/rfe62fbf9d4c314f166fe8c668e50e5d9dd882a99447f26f0367474bf@%3Cdev.tomcat.apache.org%3E https://lists.apache.org/thread.html/rfe62fbf9d4c314f166fe8c668e50e5d9dd882a99447f26f0367474bf@%3Cusers.tomcat.apache.org%3E https://lists.apache.org/thread.html/rfe62fbf9d4c314f166fe8c668e50e5d9dd882a99447f26f0367474bf%40%3Cannounce.tomcat.apache.org%3E https://lists.apache.org/thread.html/rf6d5d57b114678d8898005faef31e9fd6d7c981fcc4ccfc3bc272fc9@%3Cdev.tomcat.apache.org%3E https://lists.apache.org/thread.html/rfe62fbf9d4c314f166fe8c668e50e5d9dd882a99447f26f0367474bf@%3Cannounce.apache.org%3E
tracking as affected: tomcat: - SUSE:SLE-12-SP2:Update - SUSE:SLE-12-SP4:Update - SUSE:SLE-15:Update - SUSE:SLE-15-SP1:Update - SUSE:SLE-15-SP2:Update tomcat6: - SUSE:SLE-11:Update a bit unsure about tomcat6, please correct me if this assessment is wrong.
fix, from tomcat 10.x branch: https://github.com/apache/tomcat/commit/6d66e99ef85da93e4d2c2a536ca51aa3418bfaf4
SUSE-SU-2021:0988-1: An update that fixes two vulnerabilities is now available. Category: security (important) Bug References: 1182909,1182912 CVE References: CVE-2021-25122,CVE-2021-25329 JIRA References: Sources used: SUSE OpenStack Cloud Crowbar 9 (src): tomcat-9.0.36-3.64.1 SUSE OpenStack Cloud 9 (src): tomcat-9.0.36-3.64.1 SUSE Linux Enterprise Server for SAP 12-SP4 (src): tomcat-9.0.36-3.64.1 SUSE Linux Enterprise Server 12-SP5 (src): tomcat-9.0.36-3.64.1 SUSE Linux Enterprise Server 12-SP4-LTSS (src): tomcat-9.0.36-3.64.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2021:0989-1: An update that fixes three vulnerabilities is now available. Category: security (important) Bug References: 1180947,1182909,1182912 CVE References: CVE-2021-24122,CVE-2021-25122,CVE-2021-25329 JIRA References: Sources used: SUSE Linux Enterprise Server for SAP 15 (src): tomcat-9.0.36-3.79.1 SUSE Linux Enterprise Server 15-LTSS (src): tomcat-9.0.36-3.79.1 SUSE Linux Enterprise High Performance Computing 15-LTSS (src): tomcat-9.0.36-3.79.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS (src): tomcat-9.0.36-3.79.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2021:1008-1: An update that fixes two vulnerabilities is now available. Category: security (important) Bug References: 1182909,1182912 CVE References: CVE-2021-25122,CVE-2021-25329 JIRA References: Sources used: SUSE Linux Enterprise Module for Web Scripting 15-SP3 (src): tomcat-9.0.36-3.24.1 SUSE Linux Enterprise Module for Web Scripting 15-SP2 (src): tomcat-9.0.36-3.24.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2021:1009-1: An update that fixes three vulnerabilities is now available. Category: security (important) Bug References: 1180947,1182909,1182912 CVE References: CVE-2021-24122,CVE-2021-25122,CVE-2021-25329 JIRA References: Sources used: SUSE Manager Server 4.0 (src): tomcat-9.0.36-4.58.1 SUSE Manager Retail Branch Server 4.0 (src): tomcat-9.0.36-4.58.1 SUSE Manager Proxy 4.0 (src): tomcat-9.0.36-4.58.1 SUSE Linux Enterprise Server for SAP 15-SP1 (src): tomcat-9.0.36-4.58.1 SUSE Linux Enterprise Server 15-SP1-LTSS (src): tomcat-9.0.36-4.58.1 SUSE Linux Enterprise Server 15-SP1-BCL (src): tomcat-9.0.36-4.58.1 SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (src): tomcat-9.0.36-4.58.1 SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (src): tomcat-9.0.36-4.58.1 SUSE Enterprise Storage 6 (src): tomcat-9.0.36-4.58.1 SUSE CaaS Platform 4.0 (src): tomcat-9.0.36-4.58.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
openSUSE-SU-2021:0496-1: An update that fixes two vulnerabilities is now available. Category: security (important) Bug References: 1182909,1182912 CVE References: CVE-2021-25122,CVE-2021-25329 JIRA References: Sources used: openSUSE Leap 15.2 (src): tomcat-9.0.36-lp152.2.22.1
SUSE-SU-2021:14705-1: An update that fixes three vulnerabilities is now available. Category: security (important) Bug References: 1059554,1180947,1182909 CVE References: CVE-2017-12617,CVE-2021-24122,CVE-2021-25329 JIRA References: Sources used: SUSE Linux Enterprise Server 11-SP4-LTSS (src): tomcat6-6.0.53-0.57.19.1 SUSE Linux Enterprise Point of Sale 11-SP3 (src): tomcat6-6.0.53-0.57.19.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Patches have been submitted for all the affected packages. Nothing further to be done from our side.
SUSE-SU-2021:1431-1: An update that fixes one vulnerability is now available. Category: security (important) Bug References: 1182909 CVE References: CVE-2021-25329 JIRA References: Sources used: SUSE OpenStack Cloud Crowbar 8 (src): tomcat-8.0.53-29.46.1 SUSE OpenStack Cloud 8 (src): tomcat-8.0.53-29.46.1 SUSE Linux Enterprise Server for SAP 12-SP3 (src): tomcat-8.0.53-29.46.1 SUSE Linux Enterprise Server 12-SP3-LTSS (src): tomcat-8.0.53-29.46.1 SUSE Linux Enterprise Server 12-SP3-BCL (src): tomcat-8.0.53-29.46.1 SUSE Linux Enterprise Server 12-SP2-LTSS-SAP (src): tomcat-8.0.53-29.46.1 SUSE Linux Enterprise Server 12-SP2-LTSS-ERICSSON (src): tomcat-8.0.53-29.46.1 SUSE Linux Enterprise Server 12-SP2-BCL (src): tomcat-8.0.53-29.46.1 HPE Helion Openstack 8 (src): tomcat-8.0.53-29.46.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
It has been quite some time that this bug is open even though all the patches have been submitted. Any update?
resolved