CVE-2021-43980

Katalog CVE

CVSS 3.7 · Low EPSS 2,4%

Kerentanan Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') pada apache tomcat, debian linux. Skor CVSS 3.1 3.7 (Low) menurut NVD.

Deskripsi (NVD)

The simplified implementation of blocking reads and writes introduced in Tomcat 10 and back-ported to Tomcat 9.0.47 onwards exposed a long standing (but extremely hard to trigger) concurrency bug in Apache Tomcat 10.1.0 to 10.1.0-M12, 10.0.0-M1 to 10.0.18, 9.0.0-M1 to 9.0.60 and 8.5.0 to 8.5.77 that could cause client connections to share an Http11Processor instance resulting in responses, or part responses, to be received by the wrong client.

Rincian

Terbit di NVD

28 September 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

3.7 (Low), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

EPSS (30 hari)

2,4% peluang dieksploitasi; lebih tinggi dari 83,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://lists.apache.org/thread/3jjqbsp6j88b198x5rmg99b1qr8ht3g3 mailing list · advisory vendor
• http://www.openwall.com/lists/oss-security/2022/09/28/1 mailing list · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2022/10/msg00029.html mailing list · advisory pihak ketiga
• https://www.debian.org/security/2022/dsa-5265 advisory pihak ketiga