Bug 1441230 (CVE-2017-5650) - CVE-2017-5650 tomcat: Handling of HTTP/2 GOAWAY frame for a connection did not close streams associated with that connection
Summary: CVE-2017-5650 tomcat: Handling of HTTP/2 GOAWAY frame for a connection did no...
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2017-5650
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks: 1441210
TreeView+ depends on / blocked
 
Reported: 2017-04-11 13:10 UTC by Adam Mariš
Modified: 2020-05-14 15:56 UTC (History)
60 users (show)

Fixed In Version: tomcat 8.5.13
Clone Of:
Environment:
Last Closed: 2017-04-18 06:01:08 UTC
Embargoed:

Attachments (Terms of Use)

Description Adam Mariš 2017-04-11 13:10:58 UTC 
The handling of an HTTP/2 GOAWAY frame for a connection did not close streams associated with that connection that were currently waiting for a WINDOW_UPDATE before allowing the application to write more data. These waiting streams each consumed a thread. A malicious client could therefore construct a series of HTTP/2 requests that would consume all available processing threads.

Affected versions: 8.5.0 to 8.5.12

Upstream fix:

https://svn.apache.org/viewvc?view=revision&revision=1788480

Reference:

https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.13
Comment 1 Adam Mariš 2017-04-11 13:33:02 UTC 
Created tomcat tracking bugs for this issue:

Affects: fedora-all [bug 1441242]
Note You need to log in before you can comment on or make changes to this bug.