CVE-2021-42340

Description

The fix for bug 63362 present in Apache Tomcat 10.1.0-M1 to 10.1.0-M5, 10.0.0-M1 to 10.0.11, 9.0.40 to 9.0.53 and 8.5.60 to 8.5.71 introduced a memory leak. The object introduced to collect metrics for HTTP upgrade connections was not released for WebSocket connections once the connection was closed. This created a memory leak that, over time, could lead to a denial of service via an OutOfMemoryError.

Affected (37)

Products: Apache: Tomcat · Netapp: Hci, Management Services For Element Software · Debian: Debian Linux · +1 more

Show all products

1 product

2 products

Management Services For Element Software

Debian

1 product

Debian Linux

Oracle

14 products

Agile Engineering Data Management

Big Data Spatial And Graph

Communications Diameter Signaling Router

Hospitality Cruise Shipboard Property Management System

Managed File Transfer

Middleware Common Libraries And Tools

Payment Interface

Retail Customer Insights

Retail Data Extractor For Merchandising

Retail Eftlink

Retail Financial Integration

Retail Store Inventory Management

Sd Wan Edge

Taleo Platform

Configuration A

9 vulnerable

Vulnerable Software	Affected Versions
Apache Tomcat	From 10.0.1 to 10.0.12
Apache Tomcat	From 8.5.60 to 8.5.72
Apache Tomcat	From 9.0.40 to 9.0.54
Apache Tomcat	Version 10.0.0 milestone10
Apache Tomcat	Version 10.1.0 milestone1
Apache Tomcat	Version 10.1.0 milestone2
Apache Tomcat	Version 10.1.0 milestone3
Apache Tomcat	Version 10.1.0 milestone4
Apache Tomcat	Version 10.1.0 milestone5

Configuration B

2 vulnerable

Vulnerable Software	Affected Versions
Netapp Hci	All versions
Netapp Management Services For Element Software	All versions

Configuration C

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 11.0

Configuration D

25 vulnerable

Vulnerable Software	Affected Versions
Oracle Agile Engineering Data Management	Version 6.2.1.0
Oracle Big Data Spatial And Graph	Before 23.1
Oracle Communications Diameter Signaling Router	From 8.0.0.0 to 8.5.0.2
Oracle Hospitality Cruise Shipboard Property Management System	Version 20.1.0
Oracle Managed File Transfer	Version 12.2.1.3.0
Oracle Managed File Transfer	Version 12.2.1.4.0
Oracle Middleware Common Libraries And Tools	Version 12.2.1.4.0
Oracle Payment Interface	Version 19.1
Oracle Payment Interface	Version 20.3
Oracle Retail Customer Insights	Version 15.0.2
Oracle Retail Customer Insights	Version 16.0.2
Oracle Retail Data Extractor For Merchandising	Version 15.0.2
Oracle Retail Data Extractor For Merchandising	Version 16.0.2
Oracle Retail Eftlink	Version 21.0.0
Oracle Retail Financial Integration	Version 16.0.1
Oracle Retail Financial Integration	Version 19.0.0
Oracle Retail Store Inventory Management	Version 14.0.4.13
Oracle Retail Store Inventory Management	Version 14.1.3.14
Oracle Retail Store Inventory Management	Version 14.1.3.5
Oracle Retail Store Inventory Management	Version 15.0.3.3
Oracle Retail Store Inventory Management	Version 15.0.3.8
Oracle Retail Store Inventory Management	Version 16.0.3.7
Oracle Sd Wan Edge	Version 9.0
Oracle Sd Wan Edge	Version 9.1
Oracle Taleo Platform	All versions