What is the CVSS score of CVE-2021-42340?

CVE-2021-42340 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 11.0%.

Is there a patch available for CVE-2021-42340?

Yes, a patch is available for CVE-2021-42340. Update the affected software to the latest version immediately.

Tomcat CVE-2021-42340

HIGH

Missing Release of Resource after Effective Lifetime (CWE-772)

2021-10-14 security@apache.org

Tomcat Apache Denial Of Service Hci Management Services For Element Software Debian Linux Agile Engineering Data Management Big Data Spatial And Graph Communications Diameter Signaling Router Hospitality Cruise Shipboard Property Management System Managed File Transfer Middleware Common Libraries And Tools Payment Interface Retail Customer Insights Retail Data Extractor For Merchandising Retail Eftlink Retail Financial Integration Retail Store Inventory Management Sd Wan Edge Taleo Platform

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

CVE Published

Oct 14, 2021 - 20:15 nvd

HIGH 7.5

DescriptionNVD

The fix for bug 63362 present in Apache Tomcat 10.1.0-M1 to 10.1.0-M5, 10.0.0-M1 to 10.0.11, 9.0.40 to 9.0.53 and 8.5.60 to 8.5.71 introduced a memory leak. The object introduced to collect metrics for HTTP upgrade connections was not released for WebSocket connections once the connection was closed. This created a memory leak that, over time, could lead to a denial of service via an OutOfMemoryError.

AnalysisAI

The fix for bug 63362 present in Apache Tomcat 10.1.0-M1 to 10.1.0-M5, 10.0.0-M1 to 10.0.11, 9.0.40 to 9.0.53 and 8.5.60 to 8.5.71 introduced a memory leak. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

Technical ContextAI

This vulnerability is classified under CWE-772. The fix for bug 63362 present in Apache Tomcat 10.1.0-M1 to 10.1.0-M5, 10.0.0-M1 to 10.0.11, 9.0.40 to 9.0.53 and 8.5.60 to 8.5.71 introduced a memory leak. The object introduced to collect metrics for HTTP upgrade connections was not released for WebSocket connections once the connection was closed. This created a memory leak that, over time, could lead to a denial of service via an OutOfMemoryError. Affected products include: Apache Tomcat, Netapp Hci, Netapp Management Services For Element Software, Debian Debian Linux, Oracle Agile Engineering Data Management.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.