A specially crafted sequence of HTTP/2 requests could trigger high CPU usage for several seconds. If a sufficient number of such requests were made on concurrent HTTP/2 connections, the server could become unresponsive. Reference: https://tomcat.apache.org/security-8.html
External References: http://mail-archives.apache.org/mod_mbox/tomcat-announce/202006.mbox/%3Cfd56bc1d-1219-605b-99c7-946bf7bd8ad4%40apache.org%3E http://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.0.0-M6 http://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.36 http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.56
This vulnerability is out of security support scope for the following products: * Red Hat Jboss Fuse 6 Please refer to https://access.redhat.com/support/policy/updates/jboss_notes for more details.
Statement: Red Hat OpenStack Platform's OpenDaylight will not be updated for this flaw because it was deprecated as of RHOSP14 and is only receiving security fixes for Important and Critical flaws. Apache Tomcat versions as shipped with Red Hat Enterprise Linux 6 and 7 are not affected by this flaw as it doesn't support HTTP/2 protocol.
This issue has been addressed in the following products: Red Hat JBoss Web Server Via RHSA-2020:5173 https://access.redhat.com/errata/RHSA-2020:5173
This issue has been addressed in the following products: Red Hat JBoss Web Server 5.4 on RHEL 6 Red Hat JBoss Web Server 5.4 on RHEL 7 Red Hat JBoss Web Server 5.4 on RHEL 8 Via RHSA-2020:5170 https://access.redhat.com/errata/RHSA-2020:5170
Hello Team May I know when time we will use the patch in OCP images? https://catalog.redhat.com/software/containers/jboss-webserver-5/webserver53-openjdk8-tomcat9-openshift-rhel7 Thanks
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2020-11996
This issue has been addressed in the following products: Red Hat Openshift Application Runtimes Via RHSA-2020:5388 https://access.redhat.com/errata/RHSA-2020:5388
This issue has been addressed in the following products: Red Hat support for Spring Boot 2.3.6 Via RHSA-2021:0292 https://access.redhat.com/errata/RHSA-2021:0292
This issue has been addressed in the following products: Red Hat Fuse 7.9 Via RHSA-2021:3140 https://access.redhat.com/errata/RHSA-2021:3140