The vulnerability of the Apache Tomcat application server, related to uncontrolled resource consumption, allows attackers to cause service failures.

🗓️ 03 Dec 2019 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

Apache Tomcat vulnerability causes service failures from uncontrolled resource consumption when WINDOW_UPDATE is not sent.

Reporter	Title	Published	Views	Family All 121
IBM Security Bulletins	Security Bulletin: CVE-2019-10072	24 Jul 202021:16	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Data Risk Manager is affected by multiple vulnerabilities	13 Aug 202122:15	–	ibm
IBM Security Bulletins	Security Bulletin: IBM WebSphere Cast Iron Solution is affected by Apache Tomcat vulnerabilities CVE-2019-10072	17 Jul 201909:50	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in Apache Tomcat affects IBM Platform Symphony	2 Jul 202109:53	–	ibm
IBM Security Bulletins	Security Bulletin: IBM® Engineering Requirements Management DOORS/DWA vulnerabilities addressed in 9.7.2.8	18 Oct 202407:56	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Guardium Data Encryption (GDE)	24 Aug 202010:03	–	ibm
IBM Security Bulletins	Security Bulletin: Apache Tomcat as used in IBM QRadar SIEM is vulnerable to a denial of service (CVE-2019-10072)	15 Aug 201917:31	–	ibm
Circl	CVE-2019-10072	15 Jan 202408:41	–	circl
CISA	Apache Releases Security Advisory for Apache Tomcat	20 Jun 201900:00	–	cisa
CNVD	Apache Tomcat Resource Management Error Vulnerability	24 Jun 201900:00	–	cnvd

Vulners

Node

oracle instantis_enterprisetrackMatch17.1

oracle instantis_enterprisetrackMatch17.2

oracle instantis_enterprisetrackMatch17.3

oracle micros_relate_crm_softwareMatch11.4

oracle agile_engineering_data_managementMatch6.2.0

oracle agile_engineering_data_managementMatch6.2.1

oracle database_serverMatch12.2.0.1

oracle database_serverMatch18c

oracle database_serverMatch19c

red_hat jboss_web_serverMatch5.0

oracle retail_xstore_point_of_serviceMatch15.0

oracle retail_xstore_point_of_serviceMatch16.0

oracle retail_xstore_point_of_serviceMatch17.0

oracle retail_xstore_point_of_serviceMatch18.0

apache tomcatRange9.0.0.m1–9.0.17

apache tomcatRange8.5.0–8.5.39

apache tomcatRange7.0.0–7.0.93

oracle mysql_enterprise_monitorRange≤8.0.17

oracle communications_instant_messaging_serverMatch10.0.1.3.0

oracle oracle_communications_element_managerMatch8.0.0

oracle oracle_communications_element_managerMatch8.1.0

oracle oracle_communications_element_managerMatch8.1.1

oracle oracle_communications_element_managerMatch8.2.0

oracle oracle_communications_session_report_managerMatch8.0.0

oracle oracle_communications_session_report_managerMatch8.1.0

oracle oracle_communications_session_report_managerMatch8.1.1

oracle oracle_communications_session_report_managerMatch8.2.0

oracle oracle_communications_session_route_managerMatch8.0.0

oracle oracle_communications_session_route_managerMatch8.1.0

oracle oracle_communications_session_route_managerMatch8.1.1

oracle oracle_communications_session_route_managerMatch8.2.0

oracle oracle_agile_plm_frameworkRange9.3.3–9.3.6

oracle siebel_apps_-_marketingMatch20.7

canonical ubuntuMatch19.04

red_hat red_hat_enterprise_linuxMatch8

novell opensuse_leapMatch15.1

Source	Link
oracle	www.oracle.com/technetwork/topics/security/public-vuln-to-advisory-mapping-093627.html
oracle	www.oracle.com/security-alerts/cpuoct2019.html
nvd	www.nvd.nist.gov/vuln/detail/CVE-2019-10072
suse	www.suse.com/security/cve/CVE-2019-10072/v
oracle	www.oracle.com/security-alerts/cpuapr2020.html
oracle	www.oracle.com/security-alerts/cpujan2020.html
oracle	www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
usn	www.usn.ubuntu.com/4128-1/
usn	www.usn.ubuntu.com/4128-2/
access	www.access.redhat.com/security/cve/CVE-2019-10072

20 Nov 2020 00:00Current

6.6Medium risk

Vulners AI Score6.6

CVSS 37.5

CVSS 27.8

EPSS0.713