CVE-2021-25122: Apache Tomcat information disclosure in h2c connection handling

CVE-2021-25122 · Severity: high · CVSS 7.5 · Published 2021-06-16

Apache Tomcat, a widely used web server for Java applications, contains a flaw in how it handles certain HTTP/2 connection requests. This vulnerability could allow an unauthorized user to see sensitive information, such as headers or parts of the request body, belonging to another user's session. This could lead to the exposure of private data or session credentials.

Technologies: org.apache.tomcat:tomcat-coyote (Maven), org.apache.tomcat.embed:tomcat-embed-core (Maven). Vendors: Maven.

Quick answers

Is CVE-2021-25122 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2021-25122 being exploited in the wild.
How severe is CVE-2021-25122?
High severity, with a CVSS score of 7.5, published 16 June 2021.
Which products and versions are affected?
org.apache.tomcat:tomcat-coyote (Maven) ECOSYSTEM:introduced=10.0.0-M1,fixed=10.0.2; org.apache.tomcat.embed:tomcat-embed-core (Maven) ECOSYSTEM:introduced=10.0.0-M1,fixed=10.0.2.
Is there a fix for CVE-2021-25122?
Yes. org.apache.tomcat:tomcat-coyote (Maven): upgrade to 10.0.2 or later; org.apache.tomcat.embed:tomcat-embed-core (Maven): upgrade to 10.0.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2021-25122 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2021-25122?
Check whether you run org.apache.tomcat:tomcat-coyote (Maven) or org.apache.tomcat.embed:tomcat-embed-core (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.apache.tomcat:tomcat-coyote (Maven): upgrade to 10.0.2 or later
    # set org.apache.tomcat:tomcat-coyote to 10.0.2 in your pom.xml or build.gradle
  • org.apache.tomcat.embed:tomcat-embed-core (Maven): upgrade to 10.0.2 or later
    # set org.apache.tomcat.embed:tomcat-embed-core to 10.0.2 in your pom.xml or build.gradle

Technical details

An information disclosure vulnerability exists in Apache Tomcat's handling of HTTP/2 over cleartext (h2c) upgrade requests. When processing new h2c connections, the server may incorrectly duplicate request headers and a limited portion of the request body from one connection to another. This allows an attacker or an unrelated user to view data intended for a different request. The issue affects versions 8.5.x, 9.0.x, and 10.0.x and is categorized as CWE-200. Patches have been released in versions 8.5.63, 9.0.43, and 10.0.2.

Affected products

  • Apache Tomcat 8.5.0 to 8.5.61, 9.0.0.M1 to 9.0.41, 10.0.0-M1 to 10.0.0
  • Apache tomcat-embed-core >= 8.5.0, < 8.5.63; >= 9.0.0-M1, < 9.0.43; >= 10.0.0-M1, < 10.0.2
  • Apache tomcat-coyote >= 10.0.0-M1, < 10.0.2

Identifiers

  • CVE-2021-25122
  • GHSA-j39c-c8hj-x4j3

Timeline

  • 2021-03-01: disclosed
  • 2021-03-01: advisory: NVD publication date
  • 2021-06-16: other: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.