CVE-2021-25329

Published: Mar 1, 2021Modified: Jun 17, 2026

7.0

Vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.0 / Impact: 5.9

Source: NVD

Description

The fix for CVE-2020-9484 was incomplete. When using Apache Tomcat 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41, 8.5.0 to 8.5.61 or 7.0.0. to 7.0.107 with a configuration edge case that was highly unlikely to be used, the Tomcat instance was still vulnerable to CVE-2020-9494. Note that both the previously published prerequisites for CVE-2020-9484 and the previously published mitigations for CVE-2020-9484 also apply to this issue.

Affected (60)

Products: Apache: Tomcat · Debian: Debian Linux · Oracle: Agile Plm, Communications Cloud Native Core Policy, Communications Cloud Native Core Security Edge Protection Proxy, Communications Instant Messaging Server, Database, Graph Server And Client, Instantis Enterprisetrack, Managed File Transfer, Mysql Enterprise Monitor, Siebel Ui Framework

1 product

1 product

10 products

Communications Cloud Native Core Policy

Communications Cloud Native Core Security Edge Protection Proxy

Communications Instant Messaging Server

Database

Graph Server And Client

Instantis Enterprisetrack

Managed File Transfer

Mysql Enterprise Monitor

Siebel Ui Framework

Configuration A

41 vulnerable

Vulnerable Software	Affected Versions
Apache Tomcat	From 7.0.0 to 7.0.107
Apache Tomcat	From 8.5.0 to 8.5.61
Apache Tomcat	From 9.0.0 to 9.0.41
Apache Tomcat	Version 10.0.0
Apache Tomcat	Version 10.0.0 milestone10
Apache Tomcat	Version 10.0.0 milestone1
Apache Tomcat	Version 10.0.0 milestone2
Apache Tomcat	Version 10.0.0 milestone3
Apache Tomcat	Version 10.0.0 milestone4
Apache Tomcat	Version 10.0.0 milestone5
Apache Tomcat	Version 10.0.0 milestone6
Apache Tomcat	Version 10.0.0 milestone7
Apache Tomcat	Version 10.0.0 milestone8
Apache Tomcat	Version 10.0.0 milestone9
Apache Tomcat	Version 9.0.0 milestone10
Apache Tomcat	Version 9.0.0 milestone11
Apache Tomcat	Version 9.0.0 milestone12
Apache Tomcat	Version 9.0.0 milestone13
Apache Tomcat	Version 9.0.0 milestone14
Apache Tomcat	Version 9.0.0 milestone15
Apache Tomcat	Version 9.0.0 milestone16
Apache Tomcat	Version 9.0.0 milestone17
Apache Tomcat	Version 9.0.0 milestone18
Apache Tomcat	Version 9.0.0 milestone19
Apache Tomcat	Version 9.0.0 milestone1
Apache Tomcat	Version 9.0.0 milestone20
Apache Tomcat	Version 9.0.0 milestone21
Apache Tomcat	Version 9.0.0 milestone22
Apache Tomcat	Version 9.0.0 milestone23
Apache Tomcat	Version 9.0.0 milestone24
Apache Tomcat	Version 9.0.0 milestone25
Apache Tomcat	Version 9.0.0 milestone26
Apache Tomcat	Version 9.0.0 milestone27
Apache Tomcat	Version 9.0.0 milestone2
Apache Tomcat	Version 9.0.0 milestone3
Apache Tomcat	Version 9.0.0 milestone4
Apache Tomcat	Version 9.0.0 milestone5
Apache Tomcat	Version 9.0.0 milestone6
Apache Tomcat	Version 9.0.0 milestone7
Apache Tomcat	Version 9.0.0 milestone8
Apache Tomcat	Version 9.0.0 milestone9

Configuration B

2 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 10.0
Debian Debian Linux	Version 9.0

Configuration C

17 vulnerable

Vulnerable Software	Affected Versions
Oracle Agile Plm	Version 9.3.3
Oracle Agile Plm	Version 9.3.6
Oracle Communications Cloud Native Core Policy	Version 1.14.0
Oracle Communications Cloud Native Core Security Edge Protection Proxy	Version 1.6.0
Oracle Communications Instant Messaging Server	Version 10.0.1.5.0
Oracle Database	Version 12.2.0.1
Oracle Database	Version 19c
Oracle Database	Version 21c
Oracle Graph Server And Client	Before 21.3.0
Oracle Instantis Enterprisetrack	Version 17.1
Oracle Instantis Enterprisetrack	Version 17.2
Oracle Instantis Enterprisetrack	Version 17.3
Oracle Managed File Transfer	Version 12.2.1.3.0
Oracle Managed File Transfer	Version 12.2.1.4.0
Oracle Mysql Enterprise Monitor	Up to 8.0.23
Oracle Siebel Ui Framework	Before 21.9
Oracle Siebel Ui Framework	Version 21.9

References (40)

http://www.openwall.com/lists/oss-security/2021/03/01/2

Source: security@apache.org

Mailing ListThird Party Advisory

https://lists.apache.org/thread.html/r11ce01e8a4c7269b88f88212f21830edf73558997ac7744f37769b77%40%3Cusers.tomcat.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/r732b2ca289dc02df2de820e8775559abd6c207f159e39f559547a085%40%3Cusers.tomcat.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/r8a2ac0e476dbfc1e6440b09dcc782d444ad635d6da26f0284725a5dc%40%3Cusers.tomcat.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/rb51ccd58b2152fc75125b2406fc93e04ca9d34e737263faa6ff0f41f%40%3Cusers.tomcat.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/rf6d5d57b114678d8898005faef31e9fd6d7c981fcc4ccfc3bc272fc9%40%3Cdev.tomcat.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/rfe62fbf9d4c314f166fe8c668e50e5d9dd882a99447f26f0367474bf%40%3Cannounce.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/rfe62fbf9d4c314f166fe8c668e50e5d9dd882a99447f26f0367474bf%40%3Cannounce.tomcat.apache.org%3E

Source: security@apache.org

Mailing ListVendor Advisory

https://lists.apache.org/thread.html/rfe62fbf9d4c314f166fe8c668e50e5d9dd882a99447f26f0367474bf%40%3Cannounce.tomcat.apache.org%3E

Source: security@apache.org

Mailing ListVendor Advisory

https://lists.apache.org/thread.html/rfe62fbf9d4c314f166fe8c668e50e5d9dd882a99447f26f0367474bf%40%3Cannounce.tomcat.apache.org%3E

Source: security@apache.org

Mailing ListVendor Advisory

https://lists.apache.org/thread.html/rfe62fbf9d4c314f166fe8c668e50e5d9dd882a99447f26f0367474bf%40%3Cannounce.tomcat.apache.org%3E

Source: security@apache.org

Mailing ListVendor Advisory

https://lists.apache.org/thread.html/rfe62fbf9d4c314f166fe8c668e50e5d9dd882a99447f26f0367474bf%40%3Cdev.tomcat.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/rfe62fbf9d4c314f166fe8c668e50e5d9dd882a99447f26f0367474bf%40%3Cusers.tomcat.apache.org%3E

Source: security@apache.org

https://lists.debian.org/debian-lts-announce/2021/03/msg00018.html

Source: security@apache.org

Mailing ListThird Party Advisory

https://security.gentoo.org/glsa/202208-34

Source: security@apache.org

Third Party Advisory

https://security.netapp.com/advisory/ntap-20210409-0002/

Source: security@apache.org

Third Party Advisory

https://www.debian.org/security/2021/dsa-4891

Source: security@apache.org

Third Party Advisory

https://www.oracle.com//security-alerts/cpujul2021.html

Source: security@apache.org

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpujan2022.html

Source: security@apache.org

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpuoct2021.html

Source: security@apache.org

PatchThird Party Advisory

http://www.openwall.com/lists/oss-security/2021/03/01/2