Bug 1934061 (CVE-2021-25329) - CVE-2021-25329 tomcat: Incomplete fix for CVE-2020-9484 (RCE via session persistence)
Summary: CVE-2021-25329 tomcat: Incomplete fix for CVE-2020-9484 (RCE via session pers...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2021-25329
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1942663
Blocks: 1934010
TreeView+ depends on / blocked
 
Reported: 2021-03-02 12:09 UTC by Ted Jongseok Won
Modified: 2024-12-20 19:42 UTC (History)
79 users (show)

Fixed In Version: tomcat 10.0.2, tomcat 9.0.43, tomcat 8.5.63, tomcat 7.0.108
Clone Of:
Environment:
Last Closed: 2021-06-29 10:40:45 UTC
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2021:2561 0 None None None 2021-06-29 08:52:44 UTC
Red Hat Product Errata RHSA-2021:2562 0 None None None 2021-06-29 08:40:17 UTC
Red Hat Product Errata RHSA-2021:3425 0 None None None 2021-09-09 06:19:21 UTC
Red Hat Product Errata RHSA-2022:5532 0 None None None 2022-07-07 14:20:24 UTC

Description Ted Jongseok Won 2021-03-02 12:09:58 UTC
The fix for CVE-2020-9484 was incomplete. When using a highly unlikely configuration edge case, the Tomcat instance was still vulnerable to CVE-2020-9484. Note that both the previously published prerequisites for CVE-2020-9484 and the previously published non-upgrade mitigations for CVE-2020-9484 also apply to this issue.

Upstream commits:
Tomcat 10.0: https://github.com/apache/tomcat/commit/6d66e99ef85da93e4d2c2a536ca51aa3418bfaf4
Tomcat 9.0: https://github.com/apache/tomcat/commit/4785433a226a20df6acbea49296e1ce7e23de453
Tomcat 8.5: https://github.com/apache/tomcat/commit/93f0cc403a9210d469afc2bd9cf03ab3251c6f35
Tomcat 7.0: https://github.com/apache/tomcat/commit/74b105657ffbd1d1de80455f03446c3bbf30d1f5

Reference:
http://mail-archives.apache.org/mod_mbox/tomcat-announce/202103.mbox/%3C811bba77-e74e-9f9b-62ca-5253a09ba84f%40apache.org%3E

Comment 10 Mauro Matteo Cascella 2021-03-24 17:33:41 UTC
Statement:

In Red Hat Enterprise Linux 8, Red Hat Certificate System 10 and Identity Management are using the `pki-servlet-engine` component, which embeds a vulnerable version of Tomcat. However, in these specific contexts, the prerequisites to the vulnerability are not met. The PersistentManager is not set, and a SecurityManager is used. The use of `pki-servlet-engine` outside of these contexts is not supported. As a result, the vulnerability can not be triggered in supported configurations of these products.

Red Hat OpenStack Platform's OpenDaylight will not be updated for this flaw because it was deprecated as of OpenStack Platform 14 and is only receiving security fixes for Important and Critical flaws.

Comment 14 errata-xmlrpc 2021-06-29 08:39:57 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Web Server

Via RHSA-2021:2562 https://access.redhat.com/errata/RHSA-2021:2562

Comment 15 errata-xmlrpc 2021-06-29 08:52:32 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Web Server 5.5 on RHEL 7
  Red Hat JBoss Web Server 5.5 on RHEL 8

Via RHSA-2021:2561 https://access.redhat.com/errata/RHSA-2021:2561

Comment 16 Product Security DevOps Team 2021-06-29 10:40:45 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-25329

Comment 17 errata-xmlrpc 2021-09-09 06:19:16 UTC
This issue has been addressed in the following products:

  Red Hat support for Spring Boot 2.3.10

Via RHSA-2021:3425 https://access.redhat.com/errata/RHSA-2021:3425

Comment 20 errata-xmlrpc 2022-07-07 14:20:19 UTC
This issue has been addressed in the following products:

  Red Hat Fuse 7.11

Via RHSA-2022:5532 https://access.redhat.com/errata/RHSA-2022:5532


Note You need to log in before you can comment on or make changes to this bug.