Apache Tomcat
At a glance
- Source
- NVD
- EPSS
- EPSS 52.64 % · percentile 99 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- apache
- NVD status
- Modified
Description
If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This could lead to users seeing responses for unexpected resources.
References
- https://lists.apache.org/thread.html/r4a390027eb27e4550142fac6c8317cc684b157ae314d31514747f307%40%3Cannounce.tomcat.apache.org%3E
- https://lists.debian.org/debian-lts-announce/2020/10/msg00019.html
- http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00002.html
- http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00021.html
- https://www.debian.org/security/2021/dsa-4835
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://security.netapp.com/advisory/ntap-20201016-0007/
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | MEDIUM 4.0 | AV:N/AC:L/Au:S/C:P/I:N/A:N | NVD · nvd@nist.gov (Primary) |
Advisories
- GHSA-f268-65qc-98vg — Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat
European references
- ENISA EUVD · EUVD-2022-0967
- GCVE · GCVE-0-2020-13943
CERT-FR advisories
- CERTFR-2021-AVI-951 — Multiples vulnérabilités dans le noyau Linux de RedHat · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:apache:tomcat:8.5.0:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:8.5.1:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:8.5.2:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:8.5.3:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:8.5.4:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:8.5.5:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:8.5.6:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:8.5.7:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:8.5.8:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:8.5.9:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:8.5.10:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:8.5.11:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:8.5.12:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:8.5.13:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:8.5.14:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:8.5.15:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:8.5.16:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:8.5.17:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:8.5.18:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:8.5.19:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:8.5.20:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:8.5.21:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:8.5.22:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:8.5.23:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:8.5.24:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:8.5.25:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:8.5.26:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:8.5.27:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:8.5.28:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:8.5.29:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:8.5.30:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:8.5.31:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:8.5.32:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:8.5.33:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:8.5.34:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:8.5.35:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:8.5.36:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:8.5.37:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:8.5.38:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:8.5.39:*:*:*:*:*:*:*- +91 more
Affected products
| Product | Versions |
|---|---|
| Apache Tomcat | affected Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37, 8.5.0 to 8.5.57 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |