Missing Release of Resource after Effective Lifetime Affecting jws5-tomcat package, versions <0:9.0.50-3.redhat_00004.1.el8jws


Severity

Recommended
0.0
high
0
10

Based on Red Hat Enterprise Linux security rating.

Threat Intelligence

EPSS
4.13% (93rd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RHEL8-JWS5TOMCAT-4415183
  • published15 Oct 2021
  • disclosed14 Oct 2021

Introduced: 14 Oct 2021

CVE-2021-42340  (opens in a new tab)
CWE-772  (opens in a new tab)

How to fix?

Upgrade RHEL:8 jws5-tomcat to version 0:9.0.50-3.redhat_00004.1.el8jws or higher.
This issue was patched in RHSA-2021:4861.

NVD Description

Note: Versions mentioned in the description apply only to the upstream jws5-tomcat package and not the jws5-tomcat package as distributed by RHEL. See How to fix? for RHEL:8 relevant fixed versions and status.

The fix for bug 63362 present in Apache Tomcat 10.1.0-M1 to 10.1.0-M5, 10.0.0-M1 to 10.0.11, 9.0.40 to 9.0.53 and 8.5.60 to 8.5.71 introduced a memory leak. The object introduced to collect metrics for HTTP upgrade connections was not released for WebSocket connections once the connection was closed. This created a memory leak that, over time, could lead to a denial of service via an OutOfMemoryError.

CVSS Scores

version 3.1