CVE-2020-13934
Fixed in a distro release EPSS 64%
An h2c direct connection to Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36 and 8.5.1 to 8.5.56 did not release the HTTP/1.1 processor after the upgrade to HTTP/2. If a sufficient number of such requests were made, an OutOfMemoryException could occur leading to a denial of service.
Products: apache tomcat, debian_linux, netapp oncommand_system_manager, opensuse leap, canonical ubuntu_linux, oracle agile_engineering_data_management, oracle agile_product_lifecycle_management, oracle communications_instant_messaging_server, oracle fmw_platform, oracle instantis_enterprisetrack, oracle managed_file_transfer, oracle mysql_enterprise_monitor, oracle siebel_ui_framework, oracle workload_manager
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.apache.tomcat:tomcat | 10.0.0-M6 |
| Maven | org.apache.tomcat:tomcat | 9.0.36 |
| Maven | org.apache.tomcat:tomcat | 8.5.56 |
| Maven | org.apache.tomcat:tomcat-coyote | 10.0.0-M6 |
| Maven | org.apache.tomcat:tomcat-coyote | 9.0.36 |
| Maven | org.apache.tomcat:tomcat-coyote | 8.5.56 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Arch Linux | tomcat9 | 9.0.37-1 |
| Debian 10 | tomcat9 | 9.0.31-1~deb10u2 |
| Debian 12 | tomcat9 | 9.0.37-1 |
| Debian 13 | tomcat9 | 9.0.37-1 |
| Debian 14 | tomcat9 | 9.0.37-1 |
| Debian 9 | tomcat8 | 8.5.54-0+deb9u3 |
| Red Hat jboss enterprise web server 5.3 | jws5-tomcat | 0:9.0.30-5.redhat_6.1.el8jws |
| Red Hat jboss enterprise web server 5.3 | jws5-tomcat | 0:9.0.30-5.redhat_6.1.el7jws |
| Red Hat jboss enterprise web server 5.3 | jws5-tomcat | 0:9.0.30-5.redhat_6.1.el6jws |
| Red Hat jboss enterprise web server 5.3 | jws5-tomcat-admin-webapps | 0:9.0.30-5.redhat_6.1.el8jws |
| Red Hat jboss enterprise web server 5.3 | jws5-tomcat-admin-webapps | 0:9.0.30-5.redhat_6.1.el7jws |
| Red Hat jboss enterprise web server 5.3 | jws5-tomcat-admin-webapps | 0:9.0.30-5.redhat_6.1.el6jws |
| Red Hat jboss enterprise web server 5.3 | jws5-tomcat-docs-webapp | 0:9.0.30-5.redhat_6.1.el6jws |
| Red Hat jboss enterprise web server 5.3 | jws5-tomcat-docs-webapp | 0:9.0.30-5.redhat_6.1.el7jws |
| Red Hat jboss enterprise web server 5.3 | jws5-tomcat-docs-webapp | 0:9.0.30-5.redhat_6.1.el8jws |
| Red Hat jboss enterprise web server 5.3 | jws5-tomcat-el-3.0-api | 0:9.0.30-5.redhat_6.1.el6jws |
| Red Hat jboss enterprise web server 5.3 | jws5-tomcat-el-3.0-api | 0:9.0.30-5.redhat_6.1.el8jws |
| Red Hat jboss enterprise web server 5.3 | jws5-tomcat-el-3.0-api | 0:9.0.30-5.redhat_6.1.el7jws |
| Red Hat jboss enterprise web server 5.3 | jws5-tomcat-javadoc | 0:9.0.30-5.redhat_6.1.el6jws |
| Red Hat jboss enterprise web server 5.3 | jws5-tomcat-javadoc | 0:9.0.30-5.redhat_6.1.el8jws |
| Red Hat jboss enterprise web server 5.3 | jws5-tomcat-javadoc | 0:9.0.30-5.redhat_6.1.el7jws |
| Red Hat jboss enterprise web server 5.3 | jws5-tomcat-jsp-2.3-api | 0:9.0.30-5.redhat_6.1.el6jws |
| Red Hat jboss enterprise web server 5.3 | jws5-tomcat-jsp-2.3-api | 0:9.0.30-5.redhat_6.1.el8jws |
| Red Hat jboss enterprise web server 5.3 | jws5-tomcat-jsp-2.3-api | 0:9.0.30-5.redhat_6.1.el7jws |
| Red Hat jboss enterprise web server 5.3 | jws5-tomcat-lib | 0:9.0.30-5.redhat_6.1.el6jws |
| Red Hat jboss enterprise web server 5.3 | jws5-tomcat-lib | 0:9.0.30-5.redhat_6.1.el7jws |
| Red Hat jboss enterprise web server 5.3 | jws5-tomcat-lib | 0:9.0.30-5.redhat_6.1.el8jws |
| Red Hat jboss enterprise web server 5.3 | jws5-tomcat-selinux | 0:9.0.30-5.redhat_6.1.el6jws |
| Red Hat jboss enterprise web server 5.3 | jws5-tomcat-selinux | 0:9.0.30-5.redhat_6.1.el7jws |
| Red Hat jboss enterprise web server 5.3 | jws5-tomcat-selinux | 0:9.0.30-5.redhat_6.1.el8jws |
| Red Hat jboss enterprise web server 5.3 | jws5-tomcat-servlet-4.0-api | 0:9.0.30-5.redhat_6.1.el7jws |
| Red Hat jboss enterprise web server 5.3 | jws5-tomcat-servlet-4.0-api | 0:9.0.30-5.redhat_6.1.el6jws |
| Red Hat jboss enterprise web server 5.3 | jws5-tomcat-servlet-4.0-api | 0:9.0.30-5.redhat_6.1.el8jws |
| Red Hat jboss enterprise web server 5.3 | jws5-tomcat-webapps | 0:9.0.30-5.redhat_6.1.el7jws |
| Red Hat jboss enterprise web server 5.3 | jws5-tomcat-webapps | 0:9.0.30-5.redhat_6.1.el6jws |
| Red Hat jboss enterprise web server 5.3 | jws5-tomcat-webapps | 0:9.0.30-5.redhat_6.1.el8jws |
| SUSE Linux Enterprise High Performance Computing 15-ESPOS | tomcat | 9.0.36-3.65.2 |
| SUSE Linux Enterprise High Performance Computing 15-LTSS | tomcat | 9.0.36-3.65.2 |
| SUSE Linux Enterprise Module for Web and Scripting 15 SP1 | tomcat | 9.0.36-4.41.2 |
| SUSE Linux Enterprise Module for Web and Scripting 15 SP2 | tomcat | 9.0.36-3.6.1 |
| SUSE Linux Enterprise Server 12 SP4-LTSS | tomcat | 9.0.36-3.45.1 |
| SUSE Linux Enterprise Server 12 SP5 | tomcat | 9.0.36-3.45.1 |
| SUSE Linux Enterprise Server 12 SP5-LTSS | tomcat | 9.0.115-3.160.1 |
| SUSE Linux Enterprise Server 15-LTSS | tomcat | 9.0.36-3.65.2 |
| SUSE Linux Enterprise Server LTSS Extended Security 12 SP5 | tomcat | 9.0.115-3.160.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP4 | tomcat | 9.0.36-3.45.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP5 | tomcat | 9.0.36-3.45.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 | tomcat | 9.0.36-3.65.2 |
| SUSE OpenStack Cloud 9 | tomcat | 9.0.36-3.45.1 |
| SUSE OpenStack Cloud Crowbar 9 | tomcat | 9.0.36-3.45.1 |
| Ubuntu 20.04 LTS | tomcat9 | 9.0.31-1ubuntu0.1 |
| Ubuntu Pro 18.04 LTS | tomcat8 | no fix |
| Ubuntu Pro 18.04 LTS | tomcat9 | no fix |
| openSUSE Leap 15.1 | tomcat | 9.0.36-lp151.3.27.1 |
| openSUSE Leap 15.2 | tomcat | 9.0.36-lp152.2.4.1 |
| openSUSE Tumbleweed | tomcat | 9.0.43-8.1 |
| openSUSE Tumbleweed | tomcat10 | 10.1.14-1.1 |