7.5

CVE-2020-13934

An h2c direct connection to Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36 and 8.5.1 to 8.5.56 did not release the HTTP/1.1 processor after the upgrade to HTTP/2. If a sufficient number of such requests were made, an OutOfMemoryException could occur leading to a denial of service.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Apache ≫ Tomcat Version >= 8.5.1 <= 8.5.56
Apache ≫ Tomcat Version >= 9.0.1 <= 9.0.36
Apache ≫ Tomcat Version9.0.0 Updatemilestone10
Apache ≫ Tomcat Version9.0.0 Updatemilestone11
Apache ≫ Tomcat Version9.0.0 Updatemilestone12
Apache ≫ Tomcat Version9.0.0 Updatemilestone13
Apache ≫ Tomcat Version9.0.0 Updatemilestone14
Apache ≫ Tomcat Version9.0.0 Updatemilestone15
Apache ≫ Tomcat Version9.0.0 Updatemilestone16
Apache ≫ Tomcat Version9.0.0 Updatemilestone17
Apache ≫ Tomcat Version9.0.0 Updatemilestone18
Apache ≫ Tomcat Version9.0.0 Updatemilestone19
Apache ≫ Tomcat Version9.0.0 Updatemilestone20
Apache ≫ Tomcat Version9.0.0 Updatemilestone21
Apache ≫ Tomcat Version9.0.0 Updatemilestone22
Apache ≫ Tomcat Version9.0.0 Updatemilestone23
Apache ≫ Tomcat Version9.0.0 Updatemilestone24
Apache ≫ Tomcat Version9.0.0 Updatemilestone25
Apache ≫ Tomcat Version9.0.0 Updatemilestone26
Apache ≫ Tomcat Version9.0.0 Updatemilestone27
Apache ≫ Tomcat Version9.0.0 Updatemilestone5
Apache ≫ Tomcat Version9.0.0 Updatemilestone6
Apache ≫ Tomcat Version9.0.0 Updatemilestone7
Apache ≫ Tomcat Version9.0.0 Updatemilestone8
Apache ≫ Tomcat Version9.0.0 Updatemilestone9
Apache ≫ Tomcat Version10.0.0 Updatemilestone1
Apache ≫ Tomcat Version10.0.0 Updatemilestone2
Apache ≫ Tomcat Version10.0.0 Updatemilestone3
Apache ≫ Tomcat Version10.0.0 Updatemilestone4
Apache ≫ Tomcat Version10.0.0 Updatemilestone5
Apache ≫ Tomcat Version10.0.0 Updatemilestone6
Debian ≫ Debian Linux Version9.0
Debian ≫ Debian Linux Version10.0
Netapp ≫ Oncommand System Manager Version >= 3.0.0 <= 3.1.3
Opensuse ≫ Leap Version15.1
Opensuse ≫ Leap Version15.2
Canonical ≫ Ubuntu Linux Version20.04 SwEditionlts
Oracle ≫ Agile Plm Version9.3.3
Oracle ≫ Agile Plm Version9.3.5
Oracle ≫ Agile Plm Version9.3.6
Oracle ≫ Fmw Platform Version12.2.1.3.0
Oracle ≫ Fmw Platform Version12.2.1.4.0
Oracle ≫ Managed File Transfer Version12.2.1.3.0
Oracle ≫ Managed File Transfer Version12.2.1.4.0
Oracle ≫ Mysql Enterprise Monitor Version <= 8.0.21
Oracle ≫ Siebel Ui Framework Version <= 20.12
Oracle ≫ Workload Manager Version12.2.0.1
Oracle ≫ Workload Manager Version18c
Oracle ≫ Workload Manager Version19c
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 64.12% 0.991
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvd@nist.gov 5 10 2.9
AV:N/AC:L/Au:N/C:N/I:N/A:P
CWE-401 Missing Release of Memory after Effective Lifetime

The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

CWE-476 NULL Pointer Dereference

The product dereferences a pointer that it expects to be valid but is NULL.

https://www.oracle.com/security-alerts/cpujan2021.html
Patch
Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2022.html
Patch
Third Party Advisory
https://www.oracle.com//security-alerts/cpujul2021.html
Patch
Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2020.html
Patch
Third Party Advisory
https://www.oracle.com/security-alerts/cpuApr2021.html
Patch
Third Party Advisory
https://usn.ubuntu.com/4596-1/
Third Party Advisory
https://www.debian.org/security/2020/dsa-4727
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00084.html
Third Party Advisory
Mailing List
http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00088.html
Third Party Advisory
Mailing List
https://lists.apache.org/thread.html/r61f411cf82488d6ec213063fc15feeeb88e31b0ca9c29652ee4f962e%40%3Cannounce.tomcat.apache.org%3E
Vendor Advisory
Mailing List
Release Notes
https://lists.apache.org/thread.html/ra072b1f786e7d139e86f1d1145572e0ff71cef38a96d9c6f5362aac8%40%3Cdev.tomcat.apache.org%3E
https://lists.debian.org/debian-lts-announce/2020/07/msg00017.html
Third Party Advisory
Mailing List
https://security.netapp.com/advisory/ntap-20200724-0003/
Third Party Advisory