Bug 818160 (CVE-2021-42340) – <www-servers/tomcat-{8.5.72,9.0.54,10.0.12}: DoS via memory leak

• Product: Gentoo Security
• Status: RESOLVED FIXED

[Description John Helmert III 2021-10-14 15:53:55 UTC]

Description:
The fix for bug 63362 introduced a memory leak. The object introduced to 
collect metrics for HTTP upgrade connections was not released for 
WebSocket connections once the WebSocket connection was closed. This 
created a memory leak that, over time, could lead to a denial of service 
via an OutOfMemoryError.

Mitigation:
Users of the affected versions should apply one of the following
mitigations:
- Upgrade to Apache Tomcat 10.1.0-M6 or later
- Upgrade to Apache Tomcat 10.0.12 or later
- Upgrade to Apache Tomcat 9.0.54 or later
- Upgrade to Apache Tomcat 8.5.72 or later

[Comment 1 Larry the Git Cow 2021-10-14 16:24:26 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=a50a82307a43905f0f663dfa0c3e7e024c875dac

commit a50a82307a43905f0f663dfa0c3e7e024c875dac
Author:     Miroslav Šulc <[e-mail]>
AuthorDate: 2021-10-14 16:23:21 +0000
Commit:     Miroslav Šulc <[e-mail]>
CommitDate: 2021-10-14 16:24:24 +0000

    www-servers/tomcat: removed security affected versions
    
    Bug: https://bugs.gentoo.org/818160
    Package-Manager: Portage-3.0.28, Repoman-3.0.3
    Signed-off-by: Miroslav Šulc <[e-mail]>

 www-servers/tomcat/Manifest              |   5 -
 www-servers/tomcat/tomcat-10.0.10.ebuild | 192 -------------------------------
 www-servers/tomcat/tomcat-10.0.11.ebuild | 192 -------------------------------
 www-servers/tomcat/tomcat-8.5.71.ebuild  | 159 -------------------------
 www-servers/tomcat/tomcat-9.0.52.ebuild  | 187 ------------------------------
 www-servers/tomcat/tomcat-9.0.53.ebuild  | 187 ------------------------------
 6 files changed, 922 deletions(-)

[Comment 2 Larry the Git Cow 2021-10-14 18:08:25 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=060de4ace6f2d732b38df20f2c871b860314c061

commit 060de4ace6f2d732b38df20f2c871b860314c061
Author:     Miroslav Šulc <[e-mail]>
AuthorDate: 2021-10-14 18:08:09 +0000
Commit:     Miroslav Šulc <[e-mail]>
CommitDate: 2021-10-14 18:08:09 +0000

    www-servers/tomcat: removed security affected version
    
    Bug: https://bugs.gentoo.org/818160
    Package-Manager: Portage-3.0.28, Repoman-3.0.3
    Signed-off-by: Miroslav Šulc <[e-mail]>

 www-servers/tomcat/Manifest             |   1 -
 www-servers/tomcat/tomcat-8.5.70.ebuild | 159 --------------------------------
 2 files changed, 160 deletions(-)

[Comment 3 Miroslav Šulc 2021-10-14 18:10:30 UTC]

all affected versions are gone now. you can proceed. (the stabilization bug is still open, on purpose, as i also used it to stabilize related tomcat-servlet-api versions)

[Comment 4 John Helmert III 2021-10-14 18:58:31 UTC]

Thanks!

[Comment 5 John Helmert III 2022-08-14 01:40:17 UTC]

GLSA request filed

[Comment 6 Larry the Git Cow 2022-08-21 02:09:17 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/data/glsa.git/commit/?id=a4afff138b8507c9b0b4fdbebda4c8d1935d6238

commit a4afff138b8507c9b0b4fdbebda4c8d1935d6238
Author:     GLSAMaker <[e-mail]>
AuthorDate: 2022-08-21 01:35:21 +0000
Commit:     John Helmert III <[e-mail]>
CommitDate: 2022-08-21 01:40:47 +0000

    [ GLSA 202208-34 ] Apache Tomcat: Multiple Vulnerabilities
    
    Bug: https://bugs.gentoo.org/773571
    Bug: https://bugs.gentoo.org/801916
    Bug: https://bugs.gentoo.org/818160
    Bug: https://bugs.gentoo.org/855971
    Signed-off-by: GLSAMaker <[e-mail]>
    Signed-off-by: John Helmert III <[e-mail]>

 glsa-202208-34.xml | 69 ++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 69 insertions(+)

[Comment 7 John Helmert III 2022-08-21 02:14:28 UTC]

GLSA released, all done!