This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2021-41079 →

DEBIAN-CVE-2021-41079

Apache Tomcat 8.5.0 to 8.5.63, 9.0.0-M1 to 9.0.43 and 10.0.0-M1 to 10.0.2 did not properly validate incoming TLS packets. When Tomcat was configured t...

Original description

The description as published by the source.

Apache Tomcat 8.5.0 to 8.5.63, 9.0.0-M1 to 9.0.43 and 10.0.0-M1 to 10.0.2 did not properly validate incoming TLS packets. When Tomcat was configured to use NIO+OpenSSL or NIO2+OpenSSL for TLS, a specially crafted packet could be used to trigger an infinite loop resulting in a denial of service.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 tomcat9

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.53-1"}]}]

Debian:13 tomcat9

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.53-1"}]}]

Debian:14 tomcat9

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.53-1"}]}]

References

advisory security-tracker.debian.org