CVE-2020-13943

NameCVE-2020-13943
DescriptionIf an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This could lead to users seeing responses for unexpected resources.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
ReferencesDLA-2407-1
NVD severitymedium

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
tomcat8 (PTS)stretch8.5.54-0+deb9u1vulnerable
stretch (security)8.5.54-0+deb9u4fixed
tomcat9 (PTS)buster, buster (security)9.0.31-1~deb10u2vulnerable
bullseye, sid9.0.39-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
tomcat8sourcestretch8.5.54-0+deb9u4DLA-2407-1
tomcat8source(unstable)(unfixed)
tomcat9source(unstable)9.0.38-1

Notes

[buster] - tomcat9 <no-dsa> (Minor issue)
https://github.com/apache/tomcat/commit/55911430df13f8c9998fbdee1f9716994d2db59b (9.0.38)
https://github.com/apache/tomcat/commit/9d7def063b47407a09a2f9202beed99f4dcb292a (8.5.58)

Search for package or bug name: Reporting problems