NetSight
IP …
high7.5

CVE-2020-13934

Improper Restriction of Operations within the Bounds of a Memory Buffer in Apache Tomcat

Impact

An h2c direct connection to Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36 and 8.5.1 to 8.5.56 did not release the HTTP/1.1 processor after the upgrade to HTTP/2. If a sufficient number of such requests were made, an OutOfMemoryException could occur leading to a denial of service.

Affected packages

EcosystemPackageAffectedFixed in
mavenorg.apache.tomcat:tomcat>= 10.0.0-M1, <= 10.0.0-M510.0.0-M6
mavenorg.apache.tomcat:tomcat-coyote>= 10.0.0-M1, <= 10.0.0-M510.0.0-M6

Affected products

VendorProductAffected versions
ApacheTomcat
from 8.5.1 through 8.5.56
from 9.0.1 through 9.0.36
Versions 9.0.0, 10.0.0
DebianDebian Linux
Versions 9.0, 10.0
NetappOncommand System Manager
from 3.0.0 through 3.1.3
OpensuseLeap
Versions 15.1, 15.2
CanonicalUbuntu Linux
Version 20.04
OracleAgile Engineering Data Management
Version 6.2.1.0
OracleAgile Product Lifecycle Management
Versions 9.3.3, 9.3.5, 9.3.6
OracleCommunications Instant Messaging Server
Version 10.0.1.5.0
OracleFmw Platform
Versions 12.2.1.3.0, 12.2.1.4.0
OracleInstantis Enterprisetrack
Versions 17.1, 17.2, 17.3
OracleManaged File Transfer
Versions 12.2.1.3.0, 12.2.1.4.0
OracleMysql Enterprise Monitor
through 8.0.21

Weakness classification

CWE-401CWE-476CWE-119

References