Alerts This Week
Warning Icon 1 692
Alerts This Week
Warning Icon 1 692

Mageia 7: MGASA-2020-0397 Moderate: Tomcat HTTP/2 Stream Vulnerability Fix

mageia
Calendar Grey October 29, 2020
Dist Mageia Esm H88
Mageia 2020-0398 updates nginx packages to fix a TLS vulnerability that could result in sensitive data leakage.
If an HTTP/2 client exceeded the agreed maximum number of concurrent streams for a connection (in violation of the HTTP/2 protocol), it was possible that a subsequent request made ...

Summary

If an HTTP/2 client exceeded the agreed maximum number of concurrent streams for a connection (in violation of the HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This could lead to users seeing responses for unexpected resources (CVE-2020-13943).

References

- https://bugs.mageia.org/show_bug.cgi?id=27396

- https://tomcat.apache.org/security-9.html

- https://www.cve.org/CVERecord?id=CVE-2020-13943

Topics%20covered

Topics Covered

security advisory security update tomcat mageia http2 resource exposure stream issue

Resolution

SRPMS

- 7/core/tomcat-9.0.38-1.mga7

Publication date: 29 Oct 2020
URL: https://advisories.mageia.org/MGASA-2020-0397.html
Type: security
CVE: CVE-2020-13943

Topics%20covered

Topics Covered

security advisory security update tomcat mageia http2 resource exposure stream issue

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Related News

Your message here