{"action":"Upgrade org.apache.tomcat:tomcat to 8.5.72 (8.5.x), 9.0.54 (9.0.x), 10.0.12 (10.0.x) or 10.1.0-M6 (10.1.x) or later.","affected":[{"fixed":"10.1.0-M6","introduced":"10.1.0-M1"},{"fixed":"10.0.12","introduced":"10.0.0-M1"},{"fixed":"9.0.54","introduced":"9.0.40"},{"fixed":"8.5.72","introduced":"8.5.60"}],"component":"org.apache.tomcat:tomcat","cve_ids":["CVE-2021-42340"],"ecosystem":"Maven","epss":0.11796,"exploited":false,"fixed_versions":["10.1.0-M6","10.0.12","9.0.54","8.5.72"],"ghsa_id":"GHSA-wph7-x527-w3h5","id":"tcs_01M5N9GX1F410A645XHRSYXG4M","modified_at":"2024-03-11T16:46:20.172045Z","published_at":"2021-10-15T18:51:34Z","references":["https://osv.dev/vulnerability/GHSA-wph7-x527-w3h5","https://nvd.nist.gov/vuln/detail/CVE-2021-42340","https://github.com/apache/tomcat/commit/31d62426645824bdfe076a0c0eafa904d90b4fb9","https://github.com/apache/tomcat/commit/80f1438ec45e77a07b96419808971838d259eb47","https://github.com/apache/tomcat/commit/d27535bdee95d252418201eb21e9d29476aa6b6a","https://github.com/apache/tomcat/commit/d5a6660cba7f51589468937bf3bbad4db7810371","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.debian.org/security/2021/dsa-5009","https://tomcat.apache.org/security-9.html","https://tomcat.apache.org/security-8.html","https://tomcat.apache.org/security-10.html","https://security.netapp.com/advisory/ntap-20211104-0001","https://security.gentoo.org/glsa/202208-34","https://lists.apache.org/thread.html/r83a35be60f06aca2065f188ee542b9099695d57ced2e70e0885f905c%40%3Cannounce.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r8097a2d1550aa78e585fc77e602b9046e6d4099d8d132497c5387784@%3Ccommits.myfaces.apache.org%3E","https://kc.mcafee.com/corporate/index?page=content&id=SB10379","https://github.com/apache/tomcat"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-wph7-x527-w3h5","url":"https://osv.dev/vulnerability/GHSA-wph7-x527-w3h5"}],"summary":"Missing Release of Resource after Effective Lifetime in Apache Tomcat"}