Cette page suit l'état du correctif pour Debian. La vulnérabilité elle-même est décrite sur la page CVE principale.
Voir CVE-2021-25122 →
DEBIAN-CVE-2021-25122
When responding to new h2c connection requests, Apache Tomcat versions 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41 and 8.5.0 to 8.5.61 could duplicate req...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
When responding to new h2c connection requests, Apache Tomcat versions 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41 and 8.5.0 to 8.5.61 could duplicate request headers and a limited amount of request body from one request to another meaning user A and user B could both see the results of user A's request.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Paquets affectés
Debian:12
tomcat9
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.43-1"}]}]
Debian:13
tomcat9
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.43-1"}]}]
Debian:14
tomcat9
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.43-1"}]}]
Références
- advisory security-tracker.debian.org