[
https://issues.apache.org/jira/browse/TOMEE-3812?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Richard Zowalla resolved TOMEE-3812.
------------------------------------
Fix Version/s: 8.0.9
Resolution: Fixed
> TomEE plus is affected by CVE-2021-42340 vulnerability
> ------------------------------------------------------
>
> Key: TOMEE-3812
> URL: https://issues.apache.org/jira/browse/TOMEE-3812
> Project: TomEE
> Issue Type: Bug
> Components: TomEE Core Server
> Affects Versions: 8.0.6, 8.0.7, 9.0.0-M7, 8.0.8
> Reporter: Jayaprakash
> Priority: Major
> Labels: CVE
> Fix For: 8.0.9
>
>
> *Vulnerability description:*
> The fix for bug 63362 present in Apache Tomcat 10.1.0-M1 to 10.1.0-M5,
> 10.0.0-M1 to 10.0.11, 9.0.40 to 9.0.53 and 8.5.60 to 8.5.71 introduced a
> memory leak. The object introduced to collect metrics for HTTP upgrade
> connections was not released for WebSocket connections once the connection
> was closed. This created a memory leak that, over time, could lead to a
> denial of service via an OutOfMemoryError.
>
> Please confirm whether these memory leaks will impact TomEE ?
--
This message was sent by Atlassian Jira
(v8.20.1#820001)
