Apache Releases Security Advisory for Apache Tomcat

Threat ID:: CC-3778
Threat Severity:: Information only
Published:: 4 March 2021 12:03 PM

Report a cyber attack: call 0300 303 5222 or email [email protected]

Affected platforms

The following platforms are known to be affected:

Versions: 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41, 8.5.0 to 8.5.61, and 7.0.0 to 7.0.107

Apache Tomcat

Threat details

Introduction

The Apache Software Foundation has released a security advisory to address a vulnerability in Apache Tomcat. An remote attacker could exploit this vulnerability to execute arbitrary code.

Remediation advice

The Apache Software Foundation has released updates to address this vulnerability in all supported products. Affected organisations are encouraged to apply the following updates.

Remediation steps

Type	Step
Patch	Apache Tomcat 10 users update to the following version. https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.0.2
Patch	Apache Tomcat 9 users update to the following version. https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.43
Patch	Apache Tomcat 8 users update to the following version. https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.63
Patch	Apache Tomcat 7 users update to the following version. https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.108

CVE Vulnerabilities

Status Published

CVE-2021-25329

The fix for CVE-2020-9484 was incomplete. When using Apache Tomcat 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41, 8.5.0 to 8.5.61 or 7.0.0. to 7.0.107 with a configuration edge case that was highly unlikely to be used, the Tomcat instance was still vulnerable to CVE-2020-9494. Note that both the previously published prerequisites for CVE-2020-9484 and the previously published mitigations for CVE-2020-9484 also apply to this issue.

Last edited: 4 March 2021 12:32 pm