Uncontrolled Resource Consumption in Apache Tomcat
A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU usage for several seconds. If a sufficient number of such requests were made on concurrent HTTP/2 connections, the server could become unresponsive.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2020-11996US | high7.5 | Exploit | ||
A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU usage for several second… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00064.htmlWEB
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00072.htmlWEB
- https://github.com/apache/tomcatPACKAGE
- https://github.com/apache/tomcat/commit/9434a44d3449d620b1be70206819f8275b4a7509WEB
- https://github.com/apache/tomcat/commit/9a0231683a77e2957cea0fdee88b193b30b0c976WEB
- https://github.com/apache/tomcat/commit/c8acd2ab7371e39aeca7c306f3b5380f00afe552WEB
- https://lists.apache.org/thread.html/r2529016c311ce9485e6f173446d469600fdfbb94dccadfcd9dfdac79@%3Cusers.tomcat.apache.org%3EWEB
- https://lists.apache.org/thread.html/r3ea96d8f36dd404acce83df8aeb22a9e807d6c13ca9c5dec72f872cd@%3Cnotifications.ofbiz.apache.org%3EWEB
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan