Apache Releases Security Advisory for Apache Tomcat

Threat ID:: CC-3525
Threat Severity:: Low
Published:: 1 July 2020 12:00 AM

Report a cyber attack: call 0300 303 5222 or email [email protected]

Affected platforms

The following platforms are known to be affected:

Versions: 10.0.0-M1 to 10.0.0-M5, 9.0.0-M1 to 9.0.35, 8.5.0 to 8.5.55

Apache Tomcat

Threat details

The Apache Software Foundation has released a security advisory to address a vulnerability in Apache Tomcat. An attacker could exploit this vulnerability to cause a denial-of-service (DoS) condition.

Remediation advice

The Apache Software Foundation has released updates to address this vulnerability in all supported products. Affected organisations are encouraged to apply these updates immediately.

Remediation steps

Type	Step
Patch	Apache Tomcat 10 users update to the following version. http://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.0.0-M6
Patch	Apache Tomcat 9 users update to the following version. http://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.36
Patch	Apache Tomcat 8 users update to the following version. http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.56

Definitive source of threat updates

http://mail-archives.us.apache.org/mod_mbox/www-announce/202006.mbox/%3Cfd56bc1d-1219-605b-99c7-946bf7bd8ad4%40apache.org%3E

CVE Vulnerabilities

Status Master

CVE-2020-11996

A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU usage for several seconds. If a sufficient number of such requests were made on concurrent HTTP/2 connections, the server could become unresponsive.

Last edited: 1 July 2020 11:57 am