MGASA-2020-0331

See a problem?
Please try reporting it to the source first.
Source
https://advisories.mageia.org/MGASA-2020-0331.html
Import Source
https://advisories.mageia.org/MGASA-2020-0331.json
JSON Data
https://api.osv.dev/v1/vulns/MGASA-2020-0331
Related
Published
2020-08-18T18:47:25Z
Modified
2020-08-18T18:11:56Z
Summary
Updated tomcat packages fix security vulnerability
Details

A specially crafted sequence of HTTP/2 requests could trigger high CPU usage for several seconds. If a sufficient number of such requests were made on concurrent HTTP/2 connections, the server could become unresponsive (CVE-2020-11996).

An h2c direct connection did not release the HTTP/1.1 processor after the upgrade to HTTP/2. If a sufficient number of such requests were made, an OutOfMemoryException could occur leading to a denial of service (CVE-2020-13934).

The payload length in a WebSocket frame was not correctly validated. Invalid payload lengths could trigger an infinite loop. Multiple requests with invalid payload lengths could lead to a denial of service (CVE-2020-13935).

References
Credits

Affected packages

Mageia:7 / tomcat

Package

Name
tomcat
Purl
pkg:rpm/mageia/tomcat?distro=mageia-7

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
9.0.37-1.2.mga7

Ecosystem specific 

{
    "section": "core"
}