While investigating bug 64830 it was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request header value from the previous stream received on an HTTP/2 connection for the request associated with the subsequent stream. While this would most likely lead to an error and the closure of the HTTP/2 connection, it is possible that information could leak between requests.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

This CVE is not in the KEV list.

The EPSS score is 0.10506.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Apache Software Foundation Apache Tomcat affected
Version Status Constraints
Apache Tomcat 10 10.0.0-M1 to 10.0.0-M9 affected —
Apache Tomcat 9 9.0.0-M1 to 9.0.39 affected —
Apache Tomcat 8.5 8.5.0 to 8.5.59 affected —

Configuration 1 [-]

OR cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:9.0.0:milestone10:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:9.0.0:milestone11:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:9.0.0:milestone12:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:9.0.0:milestone13:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:9.0.0:milestone14:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:9.0.0:milestone15:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:9.0.0:milestone16:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:9.0.0:milestone17:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:9.0.0:milestone18:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:9.0.0:milestone19:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:9.0.0:milestone20:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:9.0.0:milestone21:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:9.0.0:milestone22:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:9.0.0:milestone23:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:9.0.0:milestone24:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:9.0.0:milestone25:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:9.0.0:milestone26:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:9.0.0:milestone27:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:9.0.0:milestone5:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:9.0.0:milestone6:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:9.0.0:milestone7:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:9.0.0:milestone8:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:9.0.0:milestone9:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:9.0.35-3.39.1:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:9.0.35-3.57.3:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:9.0.36:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:9.0.37:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:9.0.38:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:9.0.39:*:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:10.0.0:milestone1:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:10.0.0:milestone2:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:10.0.0:milestone3:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:10.0.0:milestone4:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:10.0.0:milestone5:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:10.0.0:milestone6:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:10.0.0:milestone7:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:10.0.0:milestone8:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:10.0.0:milestone9:*:*:*:*:*:*

Configuration 2 [-]

OR cpe:2.3:a:netapp:element_plug-in:-:*:*:*:*:vcenter_server:*:*
cpe:2.3:a:netapp:oncommand_system_manager:*:*:*:*:*:*:*:*

Configuration 3 [-]

OR cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

Configuration 4 [-]

OR cpe:2.3:a:oracle:blockchain_platform:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:1.10.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.14.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_instant_messaging_server:10.0.1.5.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:instantis_enterprisetrack:17.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:instantis_enterprisetrack:17.2:*:*:*:*:*:*:*
cpe:2.3:a:oracle:instantis_enterprisetrack:17.3:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:sd-wan_edge:9.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:workload_manager:18c:*:*:*:*:*:*:*
cpe:2.3:a:oracle:workload_manager:19c:*:*:*:*:*:*:*
Package CPE Advisory Released Date
Red Hat Fuse 7.10
tomcat cpe:/a:redhat:jboss_fuse:7 RHSA-2021:5134 2021-12-14T00:00:00Z
Red Hat JBoss Web Server 5
tomcat cpe:/a:redhat:jboss_enterprise_web_server:5.4 RHSA-2021:0495 2021-02-11T00:00:00Z
Red Hat JBoss Web Server 5.4 on RHEL 7
jws5-tomcat-0:9.0.36-9.redhat_8.1.el7jws cpe:/a:redhat:jboss_enterprise_web_server:5.4::el7 RHSA-2021:0494 2021-02-11T00:00:00Z
jws5-tomcat-native-0:1.2.25-3.redhat_3.el7jws cpe:/a:redhat:jboss_enterprise_web_server:5.4::el7 RHSA-2021:0494 2021-02-11T00:00:00Z
Red Hat JBoss Web Server 5.4 on RHEL 8
jws5-tomcat-0:9.0.36-9.redhat_8.1.el8jws cpe:/a:redhat:jboss_enterprise_web_server:5.4::el8 RHSA-2021:0494 2021-02-11T00:00:00Z
jws5-tomcat-native-0:1.2.25-3.redhat_3.el8jws cpe:/a:redhat:jboss_enterprise_web_server:5.4::el8 RHSA-2021:0494 2021-02-11T00:00:00Z
Red Hat Support for Spring Boot 2.4.9
tomcat cpe:/a:redhat:openshift_application_runtimes:1.0 RHSA-2021:4012 2021-10-28T00:00:00Z

No data.

Project Subscriptions

Vendors Products
Apache Subscribe
Tomcat Subscribe
Debian Subscribe
Debian Linux Subscribe
Netapp Subscribe
Element Plug-in Subscribe
Oncommand System Manager Subscribe
Oracle Subscribe
Blockchain Platform Subscribe
Communications Cloud Native Core Binding Support Function Subscribe
Communications Cloud Native Core Policy Subscribe
Communications Instant Messaging Server Subscribe
Instantis Enterprisetrack Subscribe
Mysql Enterprise Monitor Subscribe
Sd-wan Edge Subscribe
Workload Manager Subscribe
Redhat Subscribe
Jboss Enterprise Web Server Subscribe
Jboss Fuse Subscribe
Openshift Application Runtimes Subscribe
Advisories
Source ID Title
Debian DLA Debian DLA DLA-2495-1 tomcat8 security update
Debian DSA Debian DSA DSA-4835-1 tomcat9 security update
EUVD EUVD EUVD-2022-1215 While investigating bug 64830 it was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request header value from the previous stream received on an HTTP/2 connection for the request associated with the subsequent stream. While this would most likely lead to an error and the closure of the HTTP/2 connection, it is possible that information could leak between requests.
Github GHSA Github GHSA GHSA-vvw4-rfwf-p6hx Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat
Ubuntu USN Ubuntu USN USN-5360-1 Tomcat vulnerabilities
Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
http://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.0.0-M10 cve-icon
http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.60 cve-icon
http://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.40 cve-icon
http://www.openwall.com/lists/oss-security/2020/12/03/3 cve-icon cve-icon
https://lists.apache.org/thread.html/r26a2a66339087fc37db3caf201e446d3e83b5cce314371e235ff1784%40%3Ccommits.tomee.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r2d6e05c5ff96f8068a59dfdb3800e9ee8d4e36ce1971783c6e5f9b20%40%3Ccommits.tomee.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r5a285242737ddef4d338236328aaaf3237183e1465a5efafd16b99ed%40%3Cdev.tomcat.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r8a227ac6a755a6406c1cc47dd48800e973d4cf13fe7fe68ac59c679c%40%3Cdev.tomcat.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r9fd47f1b03e9b41d16a5cf72659b533887267d3398d963c2fff3abfa%40%3Ccommits.tomee.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/ra35c8d617b17d59f400112cebadec43ad379f98198b4a9726190d7ee%40%3Cissues.guacamole.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/ra9fcdb904dd2e2256ef90b3e4ced279cd464cb0ab63a6c64df5c010d%40%3Cannounce.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/ra9fcdb904dd2e2256ef90b3e4ced279cd464cb0ab63a6c64df5c010d%40%3Cannounce.tomcat.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/raa0e9ad388c1e6fd1e301b5e080f9439f64cb4178119a86a4801cc53%40%3Cdev.tomcat.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/rabbe6b3ae6a9795641d7a05c00d2378d5bbbe4240b7e20f09b092cce%40%3Cissues.guacamole.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/rbba08c4dcef3603e36276d49adda8eedbe458c5104314b4038f697e1%40%3Cusers.tomcat.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/rca833c6d42b7b9ce1563488c0929f29fcc95947d86e5e740258c8937%40%3Cdev.tomcat.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/rce5ac9a40173651d540babce59f6f3825f12c6d4e886ba00823b11e5%40%3Cannounce.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/rce5ac9a40173651d540babce59f6f3825f12c6d4e886ba00823b11e5%40%3Cannounce.tomcat.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/rd5babd13d7a350b369b2f647b4dd32ce678af42f9aba5389df1ae6ca%40%3Cusers.tomcat.apache.org%3E cve-icon cve-icon
https://lists.debian.org/debian-lts-announce/2020/12/msg00022.html cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2020-17527 cve-icon
https://security.gentoo.org/glsa/202012-23 cve-icon cve-icon
https://security.netapp.com/advisory/ntap-20201210-0003/ cve-icon cve-icon
https://www.cve.org/CVERecord?id=CVE-2020-17527 cve-icon
https://www.debian.org/security/2021/dsa-4835 cve-icon cve-icon
https://www.oracle.com//security-alerts/cpujul2021.html cve-icon cve-icon
https://www.oracle.com/security-alerts/cpuApr2021.html cve-icon cve-icon
https://www.oracle.com/security-alerts/cpuapr2022.html cve-icon cve-icon
https://www.oracle.com/security-alerts/cpujan2022.html cve-icon cve-icon
History

No history.

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2025-02-13T16:27:36.405Z

Reserved: 2020-08-12T00:00:00.000Z

Link: CVE-2020-17527

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2020-12-03T19:15:12.200

Modified: 2024-11-21T05:08:17.910

Link: CVE-2020-17527

cve-icon Redhat

Severity : Moderate

Publid Date: 2020-12-03T00:00:00Z

Links: CVE-2020-17527 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses