GitHub Advisory DatabaseGHSA-M7JV-HQ7H-MQ7CInfinite Loop in Apache Tomcat
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
0.154 Low
EPSS
Percentile
95.8%
The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid payload lengths could trigger an infinite loop. Multiple requests with invalid payload lengths could lead to a denial of service.
References
lists.opensuse.org/opensuse-security-announce/2020-07/msg00084.html
lists.opensuse.org/opensuse-security-announce/2020-07/msg00088.html
github.com/advisories/GHSA-m7jv-hq7h-mq7c
github.com/apache/tomcat/commit/12d715676038efbf9c728af10163f8277fc019d5
github.com/apache/tomcat/commit/1c1c77b0efb667cea80b532440b44cea1dc427c3
github.com/apache/tomcat/commit/40fa74c74822711ab878079d0a69f7357926723d
github.com/apache/tomcat/commit/4c04982870d6e730c38e21e58fb653b7cf723784
github.com/apache/tomcat/commit/f9f75c14678b68633f79030ddf4ff827f014cc84
kc.mcafee.com/corporate/index?page=content&id=SB10332
lists.apache.org/thread.html/r4e5d3c09f4dd2923191e972408b40fb8b42dbff0bc7904d44b651e50@%3Cusers.tomcat.apache.org%3E
lists.apache.org/thread.html/rd48c72bd3255bda87564d4da3791517c074d94f8a701f93b85752651%40%3Cannounce.tomcat.apache.org%3E
lists.debian.org/debian-lts-announce/2020/07/msg00017.html
nvd.nist.gov/vuln/detail/CVE-2020-13935
security.netapp.com/advisory/ntap-20200724-0003
tomcat.apache.org/security-10.html
tomcat.apache.org/security-7.html
tomcat.apache.org/security-8.html
tomcat.apache.org/security-9.html
usn.ubuntu.com/4448-1
usn.ubuntu.com/4596-1
www.debian.org/security/2020/dsa-4727
www.oracle.com//security-alerts/cpujul2021.html
www.oracle.com/security-alerts/cpuApr2021.html
www.oracle.com/security-alerts/cpuapr2022.html
www.oracle.com/security-alerts/cpujan2021.html
www.oracle.com/security-alerts/cpujan2022.html
www.oracle.com/security-alerts/cpuoct2020.html
www.oracle.com/security-alerts/cpuoct2021.html
Related
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
0.154 Low
EPSS
Percentile
95.8%