Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2021-25329

Incomplete fix for CVE-2020-9484

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
apache

Description

The fix for CVE-2020-9484 was incomplete. When using Apache Tomcat 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41, 8.5.0 to 8.5.61 or 7.0.0. to 7.0.107 with a configuration edge case that was highly unlikely to be used, the Tomcat instance was still vulnerable to CVE-2020-9494. Note that both the previously published prerequisites for CVE-2020-9484 and the previously published mitigations for CVE-2020-9484 also apply to this issue.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Apache Software Foundation Apache Tomcat

  • Apache Tomcat 10 to < 10.0.0affected
  • Apache Tomcat 9 to < 9.0.41affected
  • Apache Tomcat 8.5 to < 8.5.61affected
  • Apache Tomcat 7 to < 7.0.107affected

References