7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:N/A:N
0.003 Low
EPSS
Percentile
69.3%
Severity: Medium
Date : 2020-12-05
CVE-ID : CVE-2020-17527
Package : tomcat8
Type : information disclosure
Remote : Yes
Link : https://security.archlinux.org/AVG-1316
The package tomcat8 before version 8.5.60-1 is vulnerable to
information disclosure.
Upgrade to 8.5.60-1.
The problem has been fixed upstream in version 8.5.60.
None.
It was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1
to 9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request header value
from the previous stream received on an HTTP/2 connection for the
request associated with the subsequent stream. While this would most
likely lead to an error and the closure of the HTTP/2 connection, it is
possible that information could leak between requests.
A remote attacker might be able to access sensitive information via
well-timed HTTP/2 requests.
https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.60
https://github.com/apache/tomcat/commit/21e3408671aac7e0d7e264e720cac8b1b189eb29
https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.40
https://github.com/apache/tomcat/commit/d56293f816d6dc9e2b47107f208fa9e95db58c65
https://security.archlinux.org/CVE-2020-17527
github.com/apache/tomcat/commit/21e3408671aac7e0d7e264e720cac8b1b189eb29
github.com/apache/tomcat/commit/d56293f816d6dc9e2b47107f208fa9e95db58c65
security.archlinux.org/AVG-1316
security.archlinux.org/CVE-2020-17527
tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.60
tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.40
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:N/A:N
0.003 Low
EPSS
Percentile
69.3%