CVE: 2021-25329 found in tomcat-embed-core - Version: 9.0.36 [JAVA]

[Rajkumarr77]

Veracode Software Composition Analysis

Attribute	Details
Library	tomcat-embed-core
Description	Core Tomcat implementation
Language	JAVA
Vulnerability	Remote Code Execution
Vulnerability description	tomcat-catalina is vulnerable to remote code execution. If a remote attacker knows and is able to control the contents and name of a file, remote code execution can be achieved if the server is configured to use PersistenceManager with a FileStore and the PersistenceManager is configured with the default sessionAttributeValueClassNameFilter="null", through a request that results in the deserialization of the malicious file under the attacker's control. This CVE is due to an incomplete fix for CVE-2020-9484.
CVE	2021-25329
CVSS score	4.4
Vulnerability present in version/s	9.0.0.M1-9.0.41
Found library version/s	9.0.36
Vulnerability fixed in version	9.0.43
Library latest version	11.0.9
Fix

Links:

• https://sca.analysiscenter.veracode.com/vulnerability-database/libraries/1334?version=9.0.36
• https://sca.analysiscenter.veracode.com/vulnerability-database/vulnerabilities/29554
• Patch: apache/tomcat@4785433