CVE:CVE-2021-25122
CNNVD:CNNVD-202103-008
Apache Tomcat是美国阿帕奇（Apache）基金会的一款轻量级Web应用服务器。该程序实现了对Servlet和JavaServer Page（JSP）的支持。
Apache Tomcat versions 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41 and 8.5.0 to 8.5.61 存在信息泄露漏洞，该漏洞源于可以在一个请求到另一个请求中复制请求头和数量有限的请求体，这意味着用户a和用户B都可以看到用户a的请求结果。
solution:Upgrade apache tomcat to a higher version than 8.5.61,9.0.41,9.0.0:milestone1,9.0.0:milestone10,9.0.0:milestone11,9.0.0:milestone12,9.0.0:milestone13,9.0.0:milestone14,9.0.0:milestone15,9.0.0:milestone16,9.0.0:milestone17,9.0.0:milestone18,9.0.0:milestone19,9.0.0:milestone2,9.0.0:milestone20,9.0.0:milestone21,9.0.0:milestone22,9.0.0:milestone23,9.0.0:milestone24,9.0.0:milestone25,9.0.0:milestone26,9.0.0:milestone27,9.0.0:milestone3,9.0.0:milestone4,9.0.0:milestone5,10.0.0,10.0.0:milestone1,10.0.0:milestone10,10.0.0:milestone2,10.0.0:milestone3,10.0.0:milestone4,10.0.0:milestone5,10.0.0:milestone6,10.0.0:milestone7,10.0.0:milestone8,10.0.0:milestone9,and avoid the version [8.5.0,8.5.61],[9.0.0,9.0.41],9.0.0:milestone1,9.0.0:milestone10,9.0.0:milestone11,9.0.0:milestone12,9.0.0:milestone13,9.0.0:milestone14,9.0.0:milestone15,9.0.0:milestone16,9.0.0:milestone17,9.0.0:milestone18,9.0.0:milestone19,9.0.0:milestone2,9.0.0:milestone20,9.0.0:milestone21,9.0.0:milestone22,9.0.0:milestone23,9.0.0:milestone24,9.0.0:milestone25,9.0.0:milestone26,9.0.0:milestone27,9.0.0:milestone3,9.0.0:milestone4,9.0.0:milestone5,10.0.0,10.0.0:milestone1,10.0.0:milestone10,10.0.0:milestone2,10.0.0:milestone3,10.0.0:milestone4,10.0.0:milestone5,10.0.0:milestone6,10.0.0:milestone7,10.0.0:milestone8,10.0.0:milestone9; Upgrade debian debian_linux to a higher version than 9.0,10.0,and avoid the version 9.0,10.0; Upgrade oracle agile_plm to a higher version than 9.3.3,9.3.6,and avoid the version 9.3.3,9.3.6; Upgrade oracle communications_cloud_native_core_policy to a higher version than 1.14.0,and avoid the version 1.14.0; Upgrade oracle communications_cloud_native_core_security_edge_protection_proxy to a higher version than 1.6.0,and avoid the version 1.6.0; Upgrade oracle communications_instant_messaging_server to a higher version than 10.0.1.5.0,and avoid the version 10.0.1.5.0; Upgrade oracle database to a higher version than 12.2.0.1,19c,21c,and avoid the version 12.2.0.1,19c,21c; Upgrade oracle graph_server_and_client to a higher version than 21.3.0,21.3.0,and avoid the version (,21.3.0),21.3.0; Upgrade oracle instantis_enterprisetrack to a higher version than 17.1,17.2,17.3,and avoid the version 17.1,17.2,17.3; Upgrade oracle managed_file_transfer to a higher version than 12.2.1.3.0,12.2.1.4.0,and avoid the version 12.2.1.3.0,12.2.1.4.0; Upgrade oracle mysql_enterprise_monitor to a higher version than 8.0.23,and avoid the version (,8.0.23]; Upgrade oracle siebel_ui_framework to a higher version than 21.9,and avoid the version (,21.9]