NetSight
IP …
high7.5

CVE-2020-13935

Infinite Loop in Apache Tomcat

Impact

The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid payload lengths could trigger an infinite loop. Multiple requests with invalid payload lengths could lead to a denial of service.

Affected packages

EcosystemPackageAffectedFixed in
mavenorg.apache.tomcat:tomcat>= 10.0.0-M1, < 10.0.0-M710.0.0-M7
mavenorg.apache.tomcat.embed:tomcat-embed-websocket>= 7.0.27, < 7.0.1057.0.105
mavenorg.apache.tomcat:tomcat-websocket>= 10.0.0-M1, < 10.0.0-M710.0.0-M7

Affected products

VendorProductAffected versions
ApacheTomcat
from 7.0.27 through 7.0.104
from 8.5.0 through 8.5.56
from 9.0.1 through 9.0.36
Versions 9.0.0, 10.0.0
DebianDebian Linux
Versions 9.0, 10.0
NetappOncommand System Manager
from 3.0.0 through 3.1.3
OpensuseLeap
Versions 15.1, 15.2
CanonicalUbuntu Linux
Versions 16.04, 20.04
McafeeEpolicy Orchestrator
Versions 5.9.0, 5.9.1, 5.10.0
OracleAgile Engineering Data Management
Version 6.2.1.0
OracleAgile Product Lifecycle Management
Versions 9.3.3, 9.3.5, 9.3.6
OracleBlockchain Platform
before 21.1.2
OracleCommerce Guided Search
Version 11.3.2
OracleCommunications Cloud Native Core Policy
Version 1.14.0
OracleCommunications Instant Messaging Server
Version 10.0.1.5.0

Weakness classification

CWE-835

References