Alerts This Week
Warning Icon 1 540
Alerts This Week
Warning Icon 1 540

Mageia 7: 2021:0020 Critical: Apache Tomcat HTTP/2 Information Leak

mageia
Calendar Grey January 10, 2021
Dist Mageia Esm H88
Apache Tomcat's latest enhancement addresses a vulnerability linked to HTTP/2 streams; learn about the implications it has for Mageia 7 concerning CVE-2020-17527.
While investigating Apache issue 64830 it was discovered that Apache Tomcat could re-use an HTTP request header value from the previous stream received on an HTTP/2 connection for ...

Summary

While investigating Apache issue 64830 it was discovered that Apache Tomcat could re-use an HTTP request header value from the previous stream received on an HTTP/2 connection for the request associated with the subsequent stream. While this would most likely lead to an error and the closure of the HTTP/2 connection, it is possible that information could leak between requests (CVE-2020-17527).
The tomcat package has been updated to version 9.0.39, and patched to fix this issue.

References

- https://bugs.mageia.org/show_bug.cgi?id=27739

- https://tomcat.apache.org/security-9.html

- https://www.cve.org/CVERecord?id=CVE-2020-17527

Topics%20covered

Topics Covered

security advisory security issue information leak update critical critical fix Tomcat apache tomcat Mageia mageia HTTP/2 CVE-2020-17527 http connection

Resolution

SRPMS

- 7/core/tomcat-9.0.39-1.mga7

Severity
critical
Lowest
Low
Medium
High
Critical

Publication date: 10 Jan 2021
URL: https://advisories.mageia.org/MGASA-2021-0020.html
Type: security
CVE: CVE-2020-17527

Topics%20covered

Topics Covered

security advisory security issue information leak update critical critical fix Tomcat apache tomcat Mageia mageia HTTP/2 CVE-2020-17527 http connection

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Related News

Your message here