Description
While investigating bug 64830 it was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request header value from the previous stream received on an HTTP/2 connection for the request associated with the subsequent stream. While this would most likely lead to an error and the closure of the HTTP/2 connection, it is possible that information could leak between requests.
CVSS breakdown
CVSS 3.1
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Affected products
- apache / Tomcat9.0.0 – 9.0.0
- apache / Tomcat9.0.0 – 9.0.0
- apache / Tomcat9.0.0 – 9.0.0
- apache / Tomcat9.0.0 – 9.0.0
- apache / Tomcat9.0.35-3.39.1 – 9.0.35-3.39.1
- apache / Tomcat9.0.35-3.57.3 – 9.0.35-3.57.3
- apache / Tomcat9.0.36 – 9.0.36
- apache / Tomcat9.0.37 – 9.0.37
- apache / Tomcat9.0.38 – 9.0.38
- apache / Tomcat9.0.39 – 9.0.39
- apache / Tomcat10.0.0 – 10.0.0
- apache / Tomcat10.0.0 – 10.0.0
- apache / Tomcat10.0.0 – 10.0.0
- apache / Tomcat10.0.0 – 10.0.0
- apache / Tomcat10.0.0 – 10.0.0
- apache / Tomcat10.0.0 – 10.0.0
- apache / Tomcat10.0.0 – 10.0.0
- apache / Tomcat10.0.0 – 10.0.0
- apache / Tomcat10.0.0 – 10.0.0
- apache / Tomcat8.5.1 – 8.5.59
- apache / Tomcat9.0.0 – 9.0.0
- apache / Tomcat9.0.0 – 9.0.0
- apache / Tomcat9.0.0 – 9.0.0
- apache / Tomcat9.0.0 – 9.0.0
- apache / Tomcat9.0.0 – 9.0.0
- apache / Tomcat9.0.0 – 9.0.0
- apache / Tomcat9.0.0 – 9.0.0
- apache / Tomcat9.0.0 – 9.0.0
- apache / Tomcat9.0.0 – 9.0.0
- apache / Tomcat9.0.0 – 9.0.0
- apache / Tomcat9.0.0 – 9.0.0
- apache / Tomcat9.0.0 – 9.0.0
- apache / Tomcat9.0.0 – 9.0.0
- apache / Tomcat9.0.0 – 9.0.0
- apache / Tomcat9.0.0 – 9.0.0
- apache / Tomcat9.0.0 – 9.0.0
- apache / Tomcat9.0.0 – 9.0.0
- apache / Tomcat9.0.0 – 9.0.0
- apache / Tomcat9.0.0 – 9.0.0
- Apache Software Foundation / Apache TomcatApache Tomcat 10 10.0.0-M1 to 10.0.0-M9 – Apache Tomcat 10 10.0.0-M1 to 10.0.0-M9
- Apache Software Foundation / Apache TomcatApache Tomcat 8.5 8.5.0 to 8.5.59 – Apache Tomcat 8.5 8.5.0 to 8.5.59
- Apache Software Foundation / Apache TomcatApache Tomcat 9 9.0.0-M1 to 9.0.39 – Apache Tomcat 9 9.0.0-M1 to 9.0.39
- Debian / debian_linux9.0 – 9.0
- Debian / debian_linux10.0 – 10.0
- NetApp / element_plug-in
- NetApp / oncommand_system_manager3.0.0 – 3.1.3
- oracle / blockchain_platform21.1.2
- oracle / communications_cloud_native_core_binding_support_function1.10.0 – 1.10.0
- oracle / communications_cloud_native_core_policy1.14.0 – 1.14.0
- oracle / communications_instant_messaging_server10.0.1.5.0 – 10.0.1.5.0
- oracle / instantis_enterprisetrack17.3 – 17.3
- oracle / instantis_enterprisetrack17.2 – 17.2
- oracle / instantis_enterprisetrack17.1 – 17.1
- oracle / MySQL Enterprise Monitor8.0.23
- oracle / sd-wan_edge9.0 – 9.0
- oracle / workload_manager19c – 19c
- oracle / workload_manager18c – 18c
References
- MAILING_LISThttps://lists.apache.org/thread.html/rce5ac9a40173651d540babce59f6f3825f12c6d4e886ba00823b11e5%40%3Cannounce.tomcat.apache.org%3E
- MAILING_LISThttps://lists.apache.org/thread.html/r8a227ac6a755a6406c1cc47dd48800e973d4cf13fe7fe68ac59c679c%40%3Cdev.tomcat.apache.org%3E
- MAILING_LISThttps://lists.apache.org/thread.html/raa0e9ad388c1e6fd1e301b5e080f9439f64cb4178119a86a4801cc53%40%3Cdev.tomcat.apache.org%3E
- MAILING_LISThttps://lists.apache.org/thread.html/rce5ac9a40173651d540babce59f6f3825f12c6d4e886ba00823b11e5%40%3Cannounce.apache.org%3E
- MAILING_LISThttps://lists.apache.org/thread.html/rd5babd13d7a350b369b2f647b4dd32ce678af42f9aba5389df1ae6ca%40%3Cusers.tomcat.apache.org%3E
- MAILING_LISThttps://lists.apache.org/thread.html/rce5ac9a40173651d540babce59f6f3825f12c6d4e886ba00823b11e5%40%3Cannounce.tomcat.apache.org%3E
- MAILING_LISThttp://www.openwall.com/lists/oss-security/2020/12/03/3
- MAILING_LISThttps://lists.apache.org/thread.html/rabbe6b3ae6a9795641d7a05c00d2378d5bbbe4240b7e20f09b092cce%40%3Cissues.guacamole.apache.org%3E
- MAILING_LISThttps://lists.apache.org/thread.html/ra35c8d617b17d59f400112cebadec43ad379f98198b4a9726190d7ee%40%3Cissues.guacamole.apache.org%3E
- MAILING_LISThttps://lists.apache.org/thread.html/r9fd47f1b03e9b41d16a5cf72659b533887267d3398d963c2fff3abfa%40%3Ccommits.tomee.apache.org%3E
- MAILING_LISThttps://lists.apache.org/thread.html/r26a2a66339087fc37db3caf201e446d3e83b5cce314371e235ff1784%40%3Ccommits.tomee.apache.org%3E
- MAILING_LISThttps://lists.debian.org/debian-lts-announce/2020/12/msg00022.html
- MISChttps://security.gentoo.org/glsa/202012-23
- MAILING_LISThttps://lists.apache.org/thread.html/rca833c6d42b7b9ce1563488c0929f29fcc95947d86e5e740258c8937%40%3Cdev.tomcat.apache.org%3E
- MAILING_LISThttps://lists.apache.org/thread.html/ra9fcdb904dd2e2256ef90b3e4ced279cd464cb0ab63a6c64df5c010d%40%3Cannounce.apache.org%3E
- MAILING_LISThttps://lists.apache.org/thread.html/r5a285242737ddef4d338236328aaaf3237183e1465a5efafd16b99ed%40%3Cdev.tomcat.apache.org%3E
- MAILING_LISThttps://lists.apache.org/thread.html/ra9fcdb904dd2e2256ef90b3e4ced279cd464cb0ab63a6c64df5c010d%40%3Cannounce.tomcat.apache.org%3E
- MAILING_LISThttps://lists.apache.org/thread.html/rbba08c4dcef3603e36276d49adda8eedbe458c5104314b4038f697e1%40%3Cusers.tomcat.apache.org%3E
- VENDOR_ADVISORYhttps://www.debian.org/security/2021/dsa-4835
- MAILING_LISThttps://lists.apache.org/thread.html/r2d6e05c5ff96f8068a59dfdb3800e9ee8d4e36ce1971783c6e5f9b20%40%3Ccommits.tomee.apache.org%3E
- VENDOR_ADVISORYhttps://www.oracle.com/security-alerts/cpuApr2021.html
- MISChttps://security.netapp.com/advisory/ntap-20201210-0003/
- VENDOR_ADVISORYhttps://www.oracle.com//security-alerts/cpujul2021.html
- VENDOR_ADVISORYhttps://www.oracle.com/security-alerts/cpujan2022.html
- VENDOR_ADVISORYhttps://www.oracle.com/security-alerts/cpuapr2022.html
Updated 16m ago · 8 sources