Lucene search

K

Veracode Vulnerability DatabaseVERACODE:25889

HistoryJul 15, 2020 - 8:18 a.m.

Denial Of Service (DoS)

2020-07-1508:18:40

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

18

apache tomcat

denial of service

websocket frames

EPSS

0.148

Percentile

95.8%

apache tomcat is vulnerable to denial of service. An infinite loop to occurs when invalid payload lengths are parsed. An attacker is able to cause a denial of service condition in the application via malicious WebSocket frames with invalid payload lengths.

References

lists.opensuse.org/opensuse-security-announce/2020-07/msg00084.html

lists.opensuse.org/opensuse-security-announce/2020-07/msg00088.html

tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.0.0-M7

tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.105

tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.57

tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.37

kc.mcafee.com/corporate/index?page=content&id=SB10332

lists.apache.org/thread.html/r4e5d3c09f4dd2923191e972408b40fb8b42dbff0bc7904d44b651e50@%3Cusers.tomcat.apache.org%3E

lists.apache.org/thread.html/rd48c72bd3255bda87564d4da3791517c074d94f8a701f93b85752651%40%3Cannounce.tomcat.apache.org%3E

lists.debian.org/debian-lts-announce/2020/07/msg00017.html

security.netapp.com/advisory/ntap-20200724-0003/

usn.ubuntu.com/4448-1/

usn.ubuntu.com/4596-1/

www.debian.org/security/2020/dsa-4727

www.oracle.com//security-alerts/cpujul2021.html

www.oracle.com/security-alerts/cpuApr2021.html

www.oracle.com/security-alerts/cpuapr2022.html

www.oracle.com/security-alerts/cpujan2021.html

www.oracle.com/security-alerts/cpujan2022.html

www.oracle.com/security-alerts/cpuoct2020.html

www.oracle.com/security-alerts/cpuoct2021.html

EPSS

0.148

Percentile

95.8%