Date: Mon, 12 Oct 2020 11:03:11 +0100 From: Mark Thomas <markt@...che.org> To: oss-security@...ts.openwall.com Subject: [SECURITY] CVE-2020-13943 Apache Tomcat HTTP/2 Request mix-up CVE-2020-13943 Apache Tomcat HTTP/2 Request mix-up Severity: Moderate Vendor: The Apache Software Foundation Versions Affected: Apache Tomcat 10.0.0-M1 to 10.0.0-M7 Apache Tomcat 9.0.0.M5 to 9.0.37 Apache Tomcat 8.5.1 to 8.5.57 Description: If an HTTP/2 client exceeded the agreed maximum number of concurrent streams for a connection (in violation of the HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This could lead to users seeing responses for unexpected resources. Mitigation: - Upgrade to Apache Tomcat 10.0.0-M8 or later - Upgrade to Apache Tomcat 9.0.38 or later - Upgrade to Apache Tomcat 8.5.58 or later Credit: This issue was identified by the Apache Tomcat Security Team. References:  http://tomcat.apache.org/security-10.html  http://tomcat.apache.org/security-9.html  http://tomcat.apache.org/security-8.html
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.