[manjaro-security] [ASA-202012-3] tomcat9: information disclosure
rgacogne at archlinux.org
Wed Dec 9 19:50:26 CET 2020
rch Linux Security Advisory ASA-202012-3
Date : 2020-12-05
CVE-ID : CVE-2020-17527
Package : tomcat9
Type : information disclosure
Remote : Yes
Link : https://security.archlinux.org/AVG-1317
The package tomcat9 before version 9.0.40-1 is vulnerable to
Upgrade to 9.0.40-1.
# pacman -Syu "tomcat9>=9.0.40-1"
The problem has been fixed upstream in version 9.0.40.
It was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1
to 9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request header value
from the previous stream received on an HTTP/2 connection for the
request associated with the subsequent stream. While this would most
likely lead to an error and the closure of the HTTP/2 connection, it is
possible that information could leak between requests.
A remote attacker might be able to access sensitive information via
well-timed HTTP/2 requests.
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 840 bytes
Desc: OpenPGP digital signature
More information about the manjaro-security