[ASA-202012-3] tomcat9: information disclosure

🗓️ 05 Dec 2020 00:00:00Reported by ArchLinuxType

archlinux🔗 security.archlinux.org👁 154 Views

Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request header value from the previous stream received on an HTTP/2 connection for the request associated with the subsequent stream, leading to potential information disclosure

Reporter	Title	Published	Views	Family All 174
IBM Security Bulletins	Security Bulletin: IBM QRadar SIEM is vulnerable to Using Components with Known Vulnerabilities	27 Jul 202116:25	–	ibm
IBM Security Bulletins	Security Bulletin: : App Connect Professional is affected by Apache Tomcat vulnerabilities.	19 Mar 202112:18	–	ibm
IBM Security Bulletins	Security Bulletin: IBM® Engineering Requirements Management DOORS/DWA vulnerabilities addressed in 9.7.2.8	18 Oct 202407:56	–	ibm
IBM Security Bulletins	Security Bulletin: IBM UrbanCode Release is affected by CVE-2020-17527	25 Jan 202207:51	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Apache Tomcat Vulnerabilities Affect IBM Control Center	14 May 202121:27	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Data Risk Manager is affected by multiple vulnerabilities	2 Feb 202105:06	–	ibm
Tenable Nessus	Apache Tomcat < 10.0.0-M10 Multiple Vulnerabilities	14 Apr 202100:00	–	nessus
Tenable Nessus	Amazon Linux 2 : tomcat (ALASTOMCAT8.5-2023-010)	27 Sep 202300:00	–	nessus
Tenable Nessus	Amazon Linux AMI : tomcat8 (ALAS-2020-1473) (deprecated)	18 Dec 202000:00	–	nessus
Tenable Nessus	Amazon Linux AMI : tomcat8 (ALAS-2021-1473)	14 Jan 202100:00	–	nessus

OS	OS Version	Architecture	Package	Package Version	Filename
Arch Linux	–	any	tomcat9	9.0.40-1	tomcat9-9.0.40-1-any.pkg.tar.zst

Source	Link
security	www.security.archlinux.org/AVG-1317
tomcat	www.tomcat.apache.org/security-9.html
tomcat	www.tomcat.apache.org/security-8.html
github	www.github.com/apache/tomcat/commit/21e3408671aac7e0d7e264e720cac8b1b189eb29
github	www.github.com/apache/tomcat/commit/d56293f816d6dc9e2b47107f208fa9e95db58c65
security	www.security.archlinux.org/CVE-2020-17527

05 Dec 2020 00:00Current

1.4Low risk

Vulners AI Score1.4

CVSS 25

CVSS 3.17.5

EPSS0.24622