Discover Government News

Arch Linux Security Advisory ASA-202012-3
========================================
Severity: Medium
Date    : 2020-12-05
CVE-ID  : CVE-2020-17527
Package : tomcat9
Type    : information disclosure
Remote  : Yes
Link    : https://security.archlinux.org/AVG-1317

Summary
======
The package tomcat9 before version 9.0.40-1 is vulnerable to
information disclosure.

Resolution
=========
Upgrade to 9.0.40-1.

# pacman -Syu "tomcat9>=9.0.40-1"

The problem has been fixed upstream in version 9.0.40.

Workaround
=========
None.

Description
==========
It was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1
to 9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request header value
from the previous stream received on an HTTP/2 connection for the
request associated with the subsequent stream. While this would most
likely lead to an error and the closure of the HTTP/2 connection, it is
possible that information could leak between requests.

Impact
=====
A remote attacker might be able to access sensitive information via
well-timed HTTP/2 requests.

References
=========
https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.40
https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.60
https://github.com/apache/tomcat/commit/21e3408671aac7e0d7e264e720cac8b1b189eb29
https://github.com/apache/tomcat/commit/d56293f816d6dc9e2b47107f208fa9e95db58c65
https://security.archlinux.org/CVE-2020-17527

ArchLinux: 202012-3: tomcat9: information disclosure

December 9, 2020

Summary

It was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request header value from the previous stream received on an HTTP/2 connection for the request associated with the subsequent stream. While this would most likely lead to an error and the closure of the HTTP/2 connection, it is possible that information could leak between requests.

Resolution

Upgrade to 9.0.40-1. # pacman -Syu "tomcat9>=9.0.40-1"
The problem has been fixed upstream in version 9.0.40.

References

https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.40 https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.60 https://github.com/apache/tomcat/commit/21e3408671aac7e0d7e264e720cac8b1b189eb29 https://github.com/apache/tomcat/commit/d56293f816d6dc9e2b47107f208fa9e95db58c65 https://security.archlinux.org/CVE-2020-17527

Severity
Package : tomcat9
Type : information disclosure
Remote : Yes
Link : https://security.archlinux.org/AVG-1317

Workaround

None.

Related News