Bug 1851420 (CVE-2020-11996)
| Summary: | CVE-2020-11996 tomcat: specially crafted sequence of HTTP/2 requests can lead to DoS | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Guilherme de Almeida Suckevicz <gsuckevi> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | aakhtar, aileenc, akoufoud, alazarot, alee, almorale, anstephe, asoldano, atangrin, avibelli, bbaranow, bgeorges, bmaxwell, brian.stansberry, cdewolf, chazlett, cmoulliard, coolsvap, csutherl, darran.lofthouse, dbecker, dhanak, dkreling, dosoudil, drieden, ecerquei, eglynn, etirelli, fjuma, ggaughan, gmalinko, gzaronik, huwang, ibek, ikanello, istudens, ivan.afonichev, ivassile, iweiss, janstey, java-sig-commits, jawilson, jbalunas, jclere, jjoyce, jochrist, jolee, jpallich, jperkins, jrokos, jschatte, jschluet, jstastny, jwon, krathod, krzysztof.daniel, kverlaen, kwills, lgao, lhh, lpeer, lsvaty, lthon, mbabacek, mburns, mgarciac, mkolesni, mnovotny, mosmerov, msochure, msvehla, mszynkie, myarboro, nwallace, pdelbell, pesilva, pgallagh, pgrist, pjindal, plodge, pmackay, porcelli, psotirop, rguimara, rhcs-maint, rrajasek, rruss, rstancel, rstepani, rsvoboda, rsynek, sclewis, scohen, sdaley, slinaber, smaestri, szappis, tom.jenkinson, weli, yaoli, yozone |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | tomcat 10.0.0-M6, tomcat 9.0.36, tomcat 8.5.56 | Doc Type: | If docs needed, set a value |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2020-11-23 17:33:53 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1866871 | ||
| Bug Blocks: | 1851421 | ||
|
Description
Guilherme de Almeida Suckevicz
2020-06-26 13:31:24 UTC
External References: http://mail-archives.apache.org/mod_mbox/tomcat-announce/202006.mbox/%3Cfd56bc1d-1219-605b-99c7-946bf7bd8ad4%40apache.org%3E http://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.0.0-M6 http://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.36 http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.56 This vulnerability is out of security support scope for the following products: * Red Hat Jboss Fuse 6 Please refer to https://access.redhat.com/support/policy/updates/jboss_notes for more details. Statement: Red Hat OpenStack Platform's OpenDaylight will not be updated for this flaw because it was deprecated as of RHOSP14 and is only receiving security fixes for Important and Critical flaws. Apache Tomcat versions as shipped with Red Hat Enterprise Linux 6 and 7 are not affected by this flaw as it doesn't support HTTP/2 protocol. This issue has been addressed in the following products: Red Hat JBoss Web Server Via RHSA-2020:5173 https://access.redhat.com/errata/RHSA-2020:5173 This issue has been addressed in the following products: Red Hat JBoss Web Server 5.4 on RHEL 6 Red Hat JBoss Web Server 5.4 on RHEL 7 Red Hat JBoss Web Server 5.4 on RHEL 8 Via RHSA-2020:5170 https://access.redhat.com/errata/RHSA-2020:5170 Hello Team May I know when time we will use the patch in OCP images? https://catalog.redhat.com/software/containers/jboss-webserver-5/webserver53-openjdk8-tomcat9-openshift-rhel7 Thanks This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2020-11996 This issue has been addressed in the following products: Red Hat Openshift Application Runtimes Via RHSA-2020:5388 https://access.redhat.com/errata/RHSA-2020:5388 This issue has been addressed in the following products: Red Hat support for Spring Boot 2.3.6 Via RHSA-2021:0292 https://access.redhat.com/errata/RHSA-2021:0292 This issue has been addressed in the following products: Red Hat Fuse 7.9 Via RHSA-2021:3140 https://access.redhat.com/errata/RHSA-2021:3140 |