CVE-2020-13943

Description

If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This could lead to users seeing responses for unexpected resources.

CVSS breakdown

Affected products

• apache / Tomcat8.5.0 – 8.5.0
• apache / Tomcat8.5.1 – 8.5.1
• apache / Tomcat8.5.2 – 8.5.2
• apache / Tomcat8.5.3 – 8.5.3
• apache / Tomcat8.5.4 – 8.5.4
• apache / Tomcat8.5.5 – 8.5.5
• apache / Tomcat8.5.6 – 8.5.6
• apache / Tomcat8.5.7 – 8.5.7
• apache / Tomcat8.5.8 – 8.5.8
• apache / Tomcat8.5.9 – 8.5.9
• apache / Tomcat8.5.10 – 8.5.10
• apache / Tomcat8.5.11 – 8.5.11
• apache / Tomcat8.5.12 – 8.5.12
• apache / Tomcat8.5.13 – 8.5.13
• apache / Tomcat8.5.14 – 8.5.14
• apache / Tomcat8.5.15 – 8.5.15
• apache / Tomcat8.5.16 – 8.5.16
• apache / Tomcat8.5.17 – 8.5.17
• apache / Tomcat8.5.18 – 8.5.18
• apache / Tomcat8.5.19 – 8.5.19
• apache / Tomcat8.5.20 – 8.5.20
• apache / Tomcat8.5.21 – 8.5.21
• apache / Tomcat8.5.22 – 8.5.22
• apache / Tomcat8.5.23 – 8.5.23
• apache / Tomcat8.5.24 – 8.5.24
• apache / Tomcat8.5.25 – 8.5.25
• apache / Tomcat8.5.26 – 8.5.26
• apache / Tomcat8.5.27 – 8.5.27
• apache / Tomcat8.5.28 – 8.5.28
• apache / Tomcat8.5.29 – 8.5.29
• apache / Tomcat8.5.30 – 8.5.30
• apache / Tomcat8.5.31 – 8.5.31
• apache / Tomcat8.5.32 – 8.5.32
• apache / Tomcat8.5.33 – 8.5.33
• apache / Tomcat8.5.34 – 8.5.34
• apache / Tomcat8.5.35 – 8.5.35
• apache / Tomcat8.5.36 – 8.5.36
• apache / Tomcat8.5.37 – 8.5.37
• apache / Tomcat8.5.38 – 8.5.38
• apache / Tomcat8.5.39 – 8.5.39
• apache / Tomcat8.5.40 – 8.5.40
• apache / Tomcat8.5.41 – 8.5.41
• apache / Tomcat8.5.42 – 8.5.42
• apache / Tomcat8.5.43 – 8.5.43
• apache / Tomcat8.5.44 – 8.5.44
• apache / Tomcat8.5.45 – 8.5.45
• apache / Tomcat8.5.46 – 8.5.46
• apache / Tomcat8.5.47 – 8.5.47
• apache / Tomcat8.5.48 – 8.5.48
• apache / Tomcat8.5.49 – 8.5.49
• apache / Tomcat8.5.50 – 8.5.50
• apache / Tomcat8.5.51 – 8.5.51
• apache / Tomcat8.5.52 – 8.5.52
• apache / Tomcat8.5.53 – 8.5.53
• apache / Tomcat8.5.54 – 8.5.54
• apache / Tomcat8.5.55 – 8.5.55
• apache / Tomcat8.5.56 – 8.5.56
• apache / Tomcat8.5.57 – 8.5.57
• apache / Tomcat9.0.0 – 9.0.0
• apache / Tomcat9.0.0 – 9.0.0
• apache / Tomcat9.0.0 – 9.0.0
• apache / Tomcat9.0.0 – 9.0.0
• apache / Tomcat9.0.0 – 9.0.0
• apache / Tomcat9.0.0 – 9.0.0
• apache / Tomcat9.0.0 – 9.0.0
• apache / Tomcat9.0.0 – 9.0.0
• apache / Tomcat9.0.0 – 9.0.0
• apache / Tomcat9.0.0 – 9.0.0
• apache / Tomcat9.0.0 – 9.0.0
• apache / Tomcat9.0.0 – 9.0.0
• apache / Tomcat9.0.0 – 9.0.0
• apache / Tomcat9.0.0 – 9.0.0
• apache / Tomcat9.0.0 – 9.0.0
• apache / Tomcat9.0.0 – 9.0.0
• apache / Tomcat9.0.0 – 9.0.0
• apache / Tomcat9.0.0 – 9.0.0
• apache / Tomcat9.0.0 – 9.0.0
• apache / Tomcat9.0.0 – 9.0.0
• apache / Tomcat9.0.0 – 9.0.0
• apache / Tomcat9.0.0 – 9.0.0
• apache / Tomcat9.0.0 – 9.0.0
• apache / Tomcat9.0.1 – 9.0.1
• apache / Tomcat9.0.2 – 9.0.2
• apache / Tomcat9.0.3 – 9.0.3
• apache / Tomcat9.0.4 – 9.0.4
• apache / Tomcat9.0.5 – 9.0.5
• apache / Tomcat9.0.6 – 9.0.6
• apache / Tomcat9.0.7 – 9.0.7
• apache / Tomcat9.0.8 – 9.0.8
• apache / Tomcat9.0.9 – 9.0.9
• apache / Tomcat9.0.10 – 9.0.10
• apache / Tomcat9.0.11 – 9.0.11
• apache / Tomcat9.0.12 – 9.0.12
• apache / Tomcat9.0.13 – 9.0.13
• apache / Tomcat9.0.14 – 9.0.14
• apache / Tomcat9.0.15 – 9.0.15
• apache / Tomcat9.0.16 – 9.0.16
• apache / Tomcat9.0.17 – 9.0.17
• apache / Tomcat9.0.18 – 9.0.18
• apache / Tomcat9.0.19 – 9.0.19
• apache / Tomcat9.0.20 – 9.0.20
• apache / Tomcat9.0.21 – 9.0.21
• apache / Tomcat9.0.22 – 9.0.22
• apache / Tomcat9.0.23 – 9.0.23
• apache / Tomcat9.0.24 – 9.0.24
• apache / Tomcat9.0.25 – 9.0.25
• apache / Tomcat9.0.26 – 9.0.26
• apache / Tomcat9.0.27 – 9.0.27
• apache / Tomcat9.0.28 – 9.0.28
• apache / Tomcat9.0.29 – 9.0.29
• apache / Tomcat9.0.30 – 9.0.30
• apache / Tomcat9.0.31 – 9.0.31
• apache / Tomcat9.0.32 – 9.0.32
• apache / Tomcat9.0.33 – 9.0.33
• apache / Tomcat9.0.34 – 9.0.34
• apache / Tomcat9.0.35 – 9.0.35
• apache / Tomcat9.0.36 – 9.0.36
• apache / Tomcat9.0.37 – 9.0.37
• apache / Tomcat10.0.0 – 10.0.0
• apache / Tomcat10.0.0 – 10.0.0
• apache / Tomcat10.0.0 – 10.0.0
• apache / Tomcat10.0.0 – 10.0.0
• apache / Tomcat10.0.0 – 10.0.0
• apache / Tomcat10.0.0 – 10.0.0
• apache / Tomcat10.0.0 – 10.0.0
• Debian / debian_linux9.0 – 9.0
• Debian / debian_linux10.0 – 10.0
• oracle / instantis_enterprisetrack17.1 – 17.1
• oracle / instantis_enterprisetrack17.2 – 17.2
• oracle / instantis_enterprisetrack17.3 – 17.3
• oracle / sd-wan_edge9.0 – 9.0

References

• MAILING_LISThttps://lists.apache.org/thread.html/r4a390027eb27e4550142fac6c8317cc684b157ae314d31514747f307%40%3Cannounce.tomcat.apache.org%3E
• MAILING_LISThttps://lists.debian.org/debian-lts-announce/2020/10/msg00019.html
• MAILING_LISThttp://lists.opensuse.org/opensuse-security-announce/2020-11/msg00002.html
• MAILING_LISThttp://lists.opensuse.org/opensuse-security-announce/2020-11/msg00021.html
• VENDOR_ADVISORYhttps://www.debian.org/security/2021/dsa-4835
• VENDOR_ADVISORYhttps://www.oracle.com/security-alerts/cpuApr2021.html
• MISChttps://security.netapp.com/advisory/ntap-20201016-0007/