CVE-2020-17527
Fixed in a distro release EPSS 25%
While investigating bug 64830 it was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request header value from the previous stream received on an HTTP/2 connection for the request associated with the subsequent stream. While this would most likely lead to an error and the closure of the HTTP/2 connection, it is possible that information could leak between requests.
Products: Apache Software Foundation Apache Tomcat
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.apache.tomcat:tomcat-coyote | 10.0.0-M10 |
| Maven | org.apache.tomcat:tomcat-coyote | 9.0.40 |
| Maven | org.apache.tomcat:tomcat-coyote | 8.5.60 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian:10 | tomcat9 | 9.0.31-1~deb10u3 |
| Debian:12 | tomcat9 | 9.0.40-1 |
| Debian:13 | tomcat9 | 9.0.40-1 |
| Debian:14 | tomcat9 | 9.0.40-1 |
| Debian:9 | tomcat8 | 8.5.54-0+deb9u5 |
| Red Hat:jboss_enterprise_web_server:5.4 | jws5-tomcat | 0:9.0.36-9.redhat_8.1.el8jws |
| Red Hat:jboss_enterprise_web_server:5.4 | jws5-tomcat | 0:9.0.36-9.redhat_8.1.el7jws |
| Red Hat:jboss_enterprise_web_server:5.4 | jws5-tomcat-admin-webapps | 0:9.0.36-9.redhat_8.1.el8jws |
| Red Hat:jboss_enterprise_web_server:5.4 | jws5-tomcat-admin-webapps | 0:9.0.36-9.redhat_8.1.el7jws |
| Red Hat:jboss_enterprise_web_server:5.4 | jws5-tomcat-docs-webapp | 0:9.0.36-9.redhat_8.1.el7jws |
| Red Hat:jboss_enterprise_web_server:5.4 | jws5-tomcat-docs-webapp | 0:9.0.36-9.redhat_8.1.el8jws |
| Red Hat:jboss_enterprise_web_server:5.4 | jws5-tomcat-el-3.0-api | 0:9.0.36-9.redhat_8.1.el8jws |
| Red Hat:jboss_enterprise_web_server:5.4 | jws5-tomcat-el-3.0-api | 0:9.0.36-9.redhat_8.1.el7jws |
| Red Hat:jboss_enterprise_web_server:5.4 | jws5-tomcat-javadoc | 0:9.0.36-9.redhat_8.1.el7jws |
| Red Hat:jboss_enterprise_web_server:5.4 | jws5-tomcat-javadoc | 0:9.0.36-9.redhat_8.1.el8jws |
| Red Hat:jboss_enterprise_web_server:5.4 | jws5-tomcat-jsp-2.3-api | 0:9.0.36-9.redhat_8.1.el7jws |
| Red Hat:jboss_enterprise_web_server:5.4 | jws5-tomcat-jsp-2.3-api | 0:9.0.36-9.redhat_8.1.el8jws |
| Red Hat:jboss_enterprise_web_server:5.4 | jws5-tomcat-lib | 0:9.0.36-9.redhat_8.1.el7jws |
| Red Hat:jboss_enterprise_web_server:5.4 | jws5-tomcat-lib | 0:9.0.36-9.redhat_8.1.el8jws |
| Red Hat:jboss_enterprise_web_server:5.4 | jws5-tomcat-native | 0:1.2.25-3.redhat_3.el7jws |
| Red Hat:jboss_enterprise_web_server:5.4 | jws5-tomcat-native | 0:1.2.25-3.redhat_3.el8jws |
| Red Hat:jboss_enterprise_web_server:5.4 | jws5-tomcat-native-debuginfo | 0:1.2.25-3.redhat_3.el8jws |
| Red Hat:jboss_enterprise_web_server:5.4 | jws5-tomcat-native-debuginfo | 0:1.2.25-3.redhat_3.el7jws |
| Red Hat:jboss_enterprise_web_server:5.4 | jws5-tomcat-selinux | 0:9.0.36-9.redhat_8.1.el8jws |
| Red Hat:jboss_enterprise_web_server:5.4 | jws5-tomcat-selinux | 0:9.0.36-9.redhat_8.1.el7jws |
| Red Hat:jboss_enterprise_web_server:5.4 | jws5-tomcat-servlet-4.0-api | 0:9.0.36-9.redhat_8.1.el8jws |
| Red Hat:jboss_enterprise_web_server:5.4 | jws5-tomcat-servlet-4.0-api | 0:9.0.36-9.redhat_8.1.el7jws |
| Red Hat:jboss_enterprise_web_server:5.4 | jws5-tomcat-webapps | 0:9.0.36-9.redhat_8.1.el8jws |
| Red Hat:jboss_enterprise_web_server:5.4 | jws5-tomcat-webapps | 0:9.0.36-9.redhat_8.1.el7jws |
| SUSE:Linux Enterprise High Performance Computing 15-ESPOS | tomcat | 9.0.36-3.74.1 |
| SUSE:Linux Enterprise High Performance Computing 15-LTSS | tomcat | 9.0.36-3.74.1 |
| SUSE:Linux Enterprise Module for Web and Scripting 15 SP1 | tomcat | 9.0.36-4.53.1 |
| SUSE:Linux Enterprise Module for Web and Scripting 15 SP2 | tomcat | 9.0.36-3.18.1 |
| SUSE:Linux Enterprise Server 12 SP4-LTSS | tomcat | 9.0.36-3.58.1 |
| SUSE:Linux Enterprise Server 12 SP5 | tomcat | 9.0.36-3.58.1 |
| SUSE:Linux Enterprise Server 12 SP5-LTSS | tomcat | 9.0.115-3.160.1 |
| SUSE:Linux Enterprise Server 15-LTSS | tomcat | 9.0.36-3.74.1 |
| SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | tomcat | 9.0.115-3.160.1 |
| SUSE:Linux Enterprise Server for SAP Applications 12 SP4 | tomcat | 9.0.36-3.58.1 |
| SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | tomcat | 9.0.36-3.58.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 | tomcat | 9.0.36-3.74.1 |
| SUSE:OpenStack Cloud 9 | tomcat | 9.0.36-3.58.1 |
| SUSE:OpenStack Cloud Crowbar 9 | tomcat | 9.0.36-3.58.1 |
| Ubuntu:18.04:LTS | tomcat9 | 9.0.16-3ubuntu0.18.04.2 |
| Ubuntu:20.04:LTS | tomcat9 | 9.0.31-1ubuntu0.2 |
| Ubuntu:Pro:18.04:LTS | tomcat8 | no fix |
| openSUSE:Leap 15.1 | tomcat | 9.0.36-lp151.3.39.1 |
| openSUSE:Leap 15.2 | tomcat | 9.0.36-lp152.2.16.1 |
| openSUSE:Tumbleweed | tomcat | 9.0.36-8.4 |
| openSUSE:Tumbleweed | tomcat10 | 10.1.14-1.1 |