ALT-PU-2021-1994-2

Package update tomcat in branch sisyphus

Version9.0.45-alt1_1jpp11

Published2026-02-04

Max severityHIGH

Severity:

Closed issues (3)

HIGH7.5

Уязвимость реализации неблокирующего метода ввода/вывода («nonblocking I/O») сервера приложений Apache Tomcat, позволяющая нарушителю вызвать отказ в обслуживании

Published: 2021-07-20Modified: 2025-07-29

CVSS 3.xHIGH 7.5

CVSS:3.x/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVSS 2.0MEDIUM 5.0

CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:P

References

CVE-2021-30639

HIGH7.5

A vulnerability in Apache Tomcat allows an attacker to remotely trigger a denial of service. An error introduced as part of a change to improve error handling during non-blocking I/O meant that the error flag associated with the Request object was not reset between requests. This meant that once a non-blocking I/O error occurred, all future requests handled by that request object would fail. Users were able to trigger non-blocking I/O errors, e.g. by dropping a connection, thereby creating the possibility of triggering a DoS. Applications that do not use non-blocking I/O are not exposed to this vulnerability. This issue affects Apache Tomcat 10.0.3 to 10.0.4; 9.0.44; 8.5.64.

Published: 2021-07-12Modified: 2024-11-21

CVSS 2.0MEDIUM 5.0

CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS 3.xHIGH 7.5

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

GHSA-44qp-qhfv-c7f6

HIGH7.5

Improper Handling of Exceptional Conditions in Apache Tomcat

Published: 2021-08-13Modified: 2022-02-09

CVSS 3.xHIGH 7.5

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

Closed bugs (1)

не закрыты CVE-2020-13943, CVE-2020-17527, CVE-2021-24122, CVE-2021-25122, CVE-2021-25329