Infinite loop in Tomcat due to parsing error
High severity
GitHub Reviewed
Published
Sep 20, 2021
to the GitHub Advisory Database
•
Updated Jan 29, 2023
Package
Affected versions
>= 10.0.0, < 10.0.4
>= 9.0.0, < 9.0.44
>= 8.5.0, < 8.5.64
Patched versions
10.0.4
9.0.44
8.5.64
Description
Published by the National Vulnerability Database
Sep 16, 2021
Reviewed
Sep 17, 2021
Published to the GitHub Advisory Database
Sep 20, 2021
Last updated
Jan 29, 2023
Apache Tomcat 8.5.0 to 8.5.63, 9.0.0-M1 to 9.0.43 and 10.0.0-M1 to 10.0.2 did not properly validate incoming TLS packets. When Tomcat was configured to use NIO+OpenSSL or NIO2+OpenSSL for TLS, a specially crafted packet could be used to trigger an infinite loop resulting in a denial of service.
References