CVE-2021-42340

{"id": "CVE-2021-42340", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2021-10-14T20:15:09.060", "references": [{"url": "https://kc.mcafee.com/corporate/index?page=content&id=SB10379", "tags": ["Third Party Advisory"], "source": "security@apache.org"}, {"url": "https://lists.apache.org/thread.html/r8097a2d1550aa78e585fc77e602b9046e6d4099d8d132497c5387784%40%3Ccommits.myfaces.apache.org%3E", "source": "security@apache.org"}, {"url": "https://lists.apache.org/thread.html/r83a35be60f06aca2065f188ee542b9099695d57ced2e70e0885f905c%40%3Cannounce.tomcat.apache.org%3E", "tags": ["Mailing List", "Vendor Advisory"], "source": "security@apache.org"}, {"url": "https://security.gentoo.org/glsa/202208-34", "tags": ["Third Party Advisory"], "source": "security@apache.org"}, {"url": "https://security.netapp.com/advisory/ntap-20211104-0001/", "tags": ["Third Party Advisory"], "source": "security@apache.org"}, {"url": "https://www.debian.org/security/2021/dsa-5009", "tags": ["Third Party Advisory"], "source": "security@apache.org"}, {"url": "https://www.oracle.com/security-alerts/cpuapr2022.html", "tags": ["Patch", "Third Party Advisory"], "source": "security@apache.org"}, {"url": "https://www.oracle.com/security-alerts/cpujan2022.html", "tags": ["Patch", "Third Party Advisory"], "source": "security@apache.org"}, {"url": "https://www.oracle.com/security-alerts/cpujul2022.html", "tags": ["Patch", "Third Party Advisory"], "source": "security@apache.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-772"}]}, {"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-772"}]}], "descriptions": [{"lang": "en", "value": "The fix for bug 63362 present in Apache Tomcat 10.1.0-M1 to 10.1.0-M5, 10.0.0-M1 to 10.0.11, 9.0.40 to 9.0.53 and 8.5.60 to 8.5.71 introduced a memory leak. The object introduced to collect metrics for HTTP upgrade connections was not released for WebSocket connections once the connection was closed. This created a memory leak that, over time, could lead to a denial of service via an OutOfMemoryError."}, {"lang": "es", "value": "La correcci\u00f3n del bug 63362 presente en Apache Tomcat versiones 10.1.0-M1 hasta 10.1.0-M5, versiones 10.0.0-M1 hasta 10.0.11, versiones 9.0.40 hasta 9.0.53 y versiones 8.5.60 hasta 8.5.71, introduc\u00eda una p\u00e9rdida de memoria. El objeto introducido para recopilar m\u00e9tricas para las conexiones de actualizaci\u00f3n HTTP no se liberaba para las conexiones WebSocket una vez que se cerraba la conexi\u00f3n. Esto creaba una p\u00e9rdida de memoria que, con el tiempo, pod\u00eda conllevar a una denegaci\u00f3n de servicio por medio de un OutOfMemoryError"}], "lastModified": "2023-11-07T03:39:09.487", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "890E6FBC-FCC5-44B0-8CE8-AD7E8F0A1BFA", "versionEndExcluding": "8.5.72", "versionStartIncluding": "8.5.60"}, {"criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "654BD045-868C-4DC0-B36C-824C0F4C41CD", "versionEndExcluding": "9.0.54", "versionStartIncluding": "9.0.40"}, {"criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1C639222-18E7-4BDC-A53A-684F63C42991", "versionEndExcluding": "10.0.12", "versionStartIncluding": "10.0.1"}, {"criteria": "cpe:2.3:a:apache:tomcat:10.0.0:milestone10:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "83B9FF07-1B93-4F8C-AC56-7CA74E61B724"}, {"criteria": "cpe:2.3:a:apache:tomcat:10.1.0:milestone1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6D402B5D-5901-43EB-8E6A-ECBD512CE367"}, {"criteria": "cpe:2.3:a:apache:tomcat:10.1.0:milestone2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9846609D-51FC-4CDD-97B3-8C6E07108F14"}, {"criteria": "cpe:2.3:a:apache:tomcat:10.1.0:milestone3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2E321FB4-0B0C-497A-BB75-909D888C93CB"}, {"criteria": "cpe:2.3:a:apache:tomcat:10.1.0:milestone4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3B0CAE57-AF7A-40E6-9519-F5C9F422C1BE"}, {"criteria": "cpe:2.3:a:apache:tomcat:10.1.0:milestone5:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7CB9D150-EED6-4AE9-BCBE-48932E50035E"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:netapp:hci:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8A6E548F-62E9-40CB-85DA-FDAA0F0096C6"}, {"criteria": "cpe:2.3:a:netapp:management_services_for_element_software:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "86B51137-28D9-41F2-AFA2-3CC22B4954D1"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:oracle:agile_engineering_data_management:6.2.1.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "80C9DBB8-3D50-4D5D-859A-B022EB7C2E64"}, {"criteria": "cpe:2.3:a:oracle:big_data_spatial_and_graph:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "384DEDD9-CB26-4306-99D8-83068A9B23ED", "versionEndExcluding": "23.1"}, {"criteria": "cpe:2.3:a:oracle:communications_diameter_signaling_router:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "590ADE5F-0D0F-4576-8BA6-828758823442", "versionEndIncluding": "8.5.0.2", "versionStartIncluding": "8.0.0.0"}, {"criteria": "cpe:2.3:a:oracle:hospitality_cruise_shipboard_property_management_system:20.1.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "05F5B430-8BA1-4865-93B5-0DE89F424B53"}, {"criteria": "cpe:2.3:a:oracle:managed_file_transfer:12.2.1.3.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A2E3E923-E2AD-400D-A618-26ADF7F841A2"}, {"criteria": "cpe:2.3:a:oracle:managed_file_transfer:12.2.1.4.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9AB58D27-37F2-4A32-B786-3490024290A1"}, {"criteria": "cpe:2.3:a:oracle:middleware_common_libraries_and_tools:12.2.1.4.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9AB179A8-DFB7-4DCF-8DE3-096F376989F1"}, {"criteria": "cpe:2.3:a:oracle:payment_interface:19.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5D01A0EC-3846-4A74-A174-3797078DC699"}, {"criteria": "cpe:2.3:a:oracle:payment_interface:20.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "03E5FCFB-093A-48E9-8A4E-34C993D2764E"}, {"criteria": "cpe:2.3:a:oracle:retail_customer_insights:15.0.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3D1C35DF-D30D-42C8-B56D-C809609AB2A4"}, {"criteria": "cpe:2.3:a:oracle:retail_customer_insights:16.0.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "834B4CE7-042E-489F-AE19-0EEA2C37E7A8"}, {"criteria": "cpe:2.3:a:oracle:retail_data_extractor_for_merchandising:15.0.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "82653579-FF7D-4492-9CA2-B3DF6A708831"}, {"criteria": "cpe:2.3:a:oracle:retail_data_extractor_for_merchandising:16.0.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "32D2EB48-F9A2-4D23-81C5-4B30F2D785DF"}, {"criteria": "cpe:2.3:a:oracle:retail_eftlink:21.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F4B95628-F108-424A-8C19-40A5F5B7D37B"}, {"criteria": "cpe:2.3:a:oracle:retail_financial_integration:16.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EE6D2296-FF70-462A-963D-C93429499E4F"}, {"criteria": "cpe:2.3:a:oracle:retail_financial_integration:19.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4B7B0B33-2361-4CF5-8075-F609858A582E"}, {"criteria": "cpe:2.3:a:oracle:retail_store_inventory_management:14.0.4.13:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "88458537-6DE8-4D79-BC71-9D08883AD0C1"}, {"criteria": "cpe:2.3:a:oracle:retail_store_inventory_management:14.1.3.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2E310654-0793-41CC-B049-C754AC31D016"}, {"criteria": "cpe:2.3:a:oracle:retail_store_inventory_management:14.1.3.14:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4C5B22C6-97AF-4D1B-84C9-987C6F62C401"}, {"criteria": "cpe:2.3:a:oracle:retail_store_inventory_management:15.0.3.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FFD9AAE5-9472-49C6-B054-DB76BEB86D35"}, {"criteria": "cpe:2.3:a:oracle:retail_store_inventory_management:15.0.3.8:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A104FDBD-0B28-44EE-91A0-A0C8939865A3"}, {"criteria": "cpe:2.3:a:oracle:retail_store_inventory_management:16.0.3.7:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C2D60A4D-BB4F-4177-AFA8-A8DC8C111FB3"}, {"criteria": "cpe:2.3:a:oracle:sd-wan_edge:9.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "77E39D5C-5EFA-4FEB-909E-0A92004F2563"}, {"criteria": "cpe:2.3:a:oracle:sd-wan_edge:9.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "06816711-7C49-47B9-A9D7-FB18CC3F42F2"}, {"criteria": "cpe:2.3:a:oracle:taleo_platform:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "10009CC2-04DD-4CD3-B256-2D5EFD9A1D1D"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}