[<prev] [next>] [day] [month] [year] [list]
Date: Wed, 15 Sep 2021 18:57:33 +0100
From: Mark Thomas <markt@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2021-41079: Apache Tomcat DoS with unexpected TLS packet
Severity: high
Description:
Apache Tomcat 8.5.0 to 8.5.63, 9.0.0-M1 to 9.0.43 and 10.0.0-M1 to
10.0.2 did not properly validate incoming TLS packets. When Tomcat was
configured to use NIO+OpenSSL or NIO2+OpenSSL for TLS, a specially
crafted packet could be used to trigger an infinite loop resulting in a
denial of service.
Credit:
The Apache Tomcat security team would like to thank Thomas Wozenilek for
originally reporting this issue and David Frankson of Infinite Campus
for also providing a test case that reproduced the issue.
References:
https://lists.apache.org/thread.html/rccdef0349fdf4fb73a4e4403095446d7fe6264e0a58e2df5c6799434%40%3Cannounce.tomcat.apache.org%3E
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
