CVE-2020-13943
Fixed in a distro release EPSS 55%
If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This could lead to users seeing responses for unexpected resources.
Products: apache tomcat, debian_linux, oracle instantis_enterprisetrack, oracle sd-wan_edge
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.apache.tomcat:tomcat-coyote | 10.0.0-M8 |
| Maven | org.apache.tomcat:tomcat-coyote | 9.0.38 |
| Maven | org.apache.tomcat:tomcat-coyote | 8.5.58 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 10 | tomcat9 | 9.0.31-1~deb10u3 |
| Debian 12 | tomcat9 | 9.0.38-1 |
| Debian 13 | tomcat9 | 9.0.38-1 |
| Debian 14 | tomcat9 | 9.0.38-1 |
| Debian 9 | tomcat8 | 8.5.54-0+deb9u4 |
| Red Hat jboss enterprise web server 5.4 | jws5-tomcat | 0:9.0.36-9.redhat_8.1.el7jws |
| Red Hat jboss enterprise web server 5.4 | jws5-tomcat | 0:9.0.36-9.redhat_8.1.el8jws |
| Red Hat jboss enterprise web server 5.4 | jws5-tomcat-admin-webapps | 0:9.0.36-9.redhat_8.1.el8jws |
| Red Hat jboss enterprise web server 5.4 | jws5-tomcat-admin-webapps | 0:9.0.36-9.redhat_8.1.el7jws |
| Red Hat jboss enterprise web server 5.4 | jws5-tomcat-docs-webapp | 0:9.0.36-9.redhat_8.1.el7jws |
| Red Hat jboss enterprise web server 5.4 | jws5-tomcat-docs-webapp | 0:9.0.36-9.redhat_8.1.el8jws |
| Red Hat jboss enterprise web server 5.4 | jws5-tomcat-el-3.0-api | 0:9.0.36-9.redhat_8.1.el8jws |
| Red Hat jboss enterprise web server 5.4 | jws5-tomcat-el-3.0-api | 0:9.0.36-9.redhat_8.1.el7jws |
| Red Hat jboss enterprise web server 5.4 | jws5-tomcat-javadoc | 0:9.0.36-9.redhat_8.1.el7jws |
| Red Hat jboss enterprise web server 5.4 | jws5-tomcat-javadoc | 0:9.0.36-9.redhat_8.1.el8jws |
| Red Hat jboss enterprise web server 5.4 | jws5-tomcat-jsp-2.3-api | 0:9.0.36-9.redhat_8.1.el7jws |
| Red Hat jboss enterprise web server 5.4 | jws5-tomcat-jsp-2.3-api | 0:9.0.36-9.redhat_8.1.el8jws |
| Red Hat jboss enterprise web server 5.4 | jws5-tomcat-lib | 0:9.0.36-9.redhat_8.1.el8jws |
| Red Hat jboss enterprise web server 5.4 | jws5-tomcat-lib | 0:9.0.36-9.redhat_8.1.el7jws |
| Red Hat jboss enterprise web server 5.4 | jws5-tomcat-native | 0:1.2.25-3.redhat_3.el8jws |
| Red Hat jboss enterprise web server 5.4 | jws5-tomcat-native | 0:1.2.25-3.redhat_3.el7jws |
| Red Hat jboss enterprise web server 5.4 | jws5-tomcat-native-debuginfo | 0:1.2.25-3.redhat_3.el7jws |
| Red Hat jboss enterprise web server 5.4 | jws5-tomcat-native-debuginfo | 0:1.2.25-3.redhat_3.el8jws |
| Red Hat jboss enterprise web server 5.4 | jws5-tomcat-selinux | 0:9.0.36-9.redhat_8.1.el7jws |
| Red Hat jboss enterprise web server 5.4 | jws5-tomcat-selinux | 0:9.0.36-9.redhat_8.1.el8jws |
| Red Hat jboss enterprise web server 5.4 | jws5-tomcat-servlet-4.0-api | 0:9.0.36-9.redhat_8.1.el7jws |
| Red Hat jboss enterprise web server 5.4 | jws5-tomcat-servlet-4.0-api | 0:9.0.36-9.redhat_8.1.el8jws |
| Red Hat jboss enterprise web server 5.4 | jws5-tomcat-webapps | 0:9.0.36-9.redhat_8.1.el7jws |
| Red Hat jboss enterprise web server 5.4 | jws5-tomcat-webapps | 0:9.0.36-9.redhat_8.1.el8jws |
| SUSE Linux Enterprise High Performance Computing 15-ESPOS | tomcat | 9.0.36-3.74.1 |
| SUSE Linux Enterprise High Performance Computing 15-LTSS | tomcat | 9.0.36-3.74.1 |
| SUSE Linux Enterprise Module for Web and Scripting 15 SP1 | tomcat | 9.0.36-4.47.3 |
| SUSE Linux Enterprise Module for Web and Scripting 15 SP2 | tomcat | 9.0.36-3.12.3 |
| SUSE Linux Enterprise Server 12 SP5 | tomcat | 9.0.36-3.50.1 |
| SUSE Linux Enterprise Server 12 SP5-LTSS | tomcat | 9.0.115-3.160.1 |
| SUSE Linux Enterprise Server 15-LTSS | tomcat | 9.0.36-3.74.1 |
| SUSE Linux Enterprise Server LTSS Extended Security 12 SP5 | tomcat | 9.0.115-3.160.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP5 | tomcat | 9.0.36-3.50.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 | tomcat | 9.0.36-3.74.1 |
| Ubuntu 18.04 LTS | tomcat9 | 9.0.16-3ubuntu0.18.04.2 |
| Ubuntu 20.04 LTS | tomcat9 | 9.0.31-1ubuntu0.2 |
| openSUSE Leap 15.1 | tomcat | 9.0.36-lp151.3.33.1 |
| openSUSE Leap 15.2 | tomcat | 9.0.36-lp152.2.10.1 |
| openSUSE Tumbleweed | tomcat | 9.0.36-8.4 |
| openSUSE Tumbleweed | tomcat10 | 10.1.14-1.1 |