Staging Environment: Content and features may be unstable or change without notice.
Advisory details: gitlab / maven/org.apache.tomcat/tomcat/CVE-2020-13934
Advisory ID gitlab/maven/org.apache.tomcat/tomcat/CVE-2020-13934
Aliases CVE-2020-13934
GHSA-vf77-8h7g-gghp
Summary Improper Restriction of Operations within the Bounds of a Memory Buffer in Apache Tomcat An h2c direct connection to Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36 and 8.5.1 to 8.5.56 did not release the HTTP/1.1 processor after the upgrade to HTTP/2. If a sufficient number of such requests were made, an OutOfMemoryException could occur leading to a denial of service.
Status Published
Exploitability 0.5
Weighted Severity 0.0
Risk
Affected and Fixed Packages Package Details
Introduced and Fixed Package Commit Patches Package Commit Patches Details
Weaknesses (4)
CWE-476 NULL Pointer Dereference
CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3.1 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.tomcat/tomcat/CVE-2020-13934.yml
Reference id Reference type URL
https://lists.apache.org/thread.html/r61f411cf82488d6ec213063fc15feeeb88e31b0ca9c29652ee4f962e%40%3Cannounce.tomcat.apache.org%3E
https://lists.apache.org/thread.html/ra072b1f786e7d139e86f1d1145572e0ff71cef38a96d9c6f5362aac8@%3Cdev.tomcat.apache.org%3E
https://lists.debian.org/debian-lts-announce/2020/07/msg00017.html
https://security.netapp.com/advisory/ntap-20200724-0003
https://usn.ubuntu.com/4596-1
https://www.debian.org/security/2020/dsa-4727
https://www.oracle.com/security-alerts/cpujan2021.html
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuoct2020.html
cpuApr2021.html Other https://www.oracle.com/security-alerts/cpuApr2021.html
cpujan2022.html Other https://www.oracle.com/security-alerts/cpujan2022.html
CVE-2020-13934 https://nvd.nist.gov/vuln/detail/CVE-2020-13934
GHSA-vf77-8h7g-gghp https://github.com/advisories/GHSA-vf77-8h7g-gghp
No exploits are available.

No EPSS data available for this advisory.

Patch URL
There are no known patches.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.tomcat/tomcat/CVE-2020-13934.yml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

There are no SSVC decisions available.