Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

openSUSE-SU-2020:1842-1

Опубликовано: 05 нояб. 2020
Источник: suse-cvrf

Описание

Security update for tomcat

This update for tomcat fixes the following issues:

  • CVE-2020-13943: Fixed HTTP/2 Request mix-up (bsc#1177582)

This update was imported from the SUSE:SLE-15-SP1:Update update project.

Список пакетов

openSUSE Leap 15.1
tomcat-9.0.36-lp151.3.33.1
tomcat-admin-webapps-9.0.36-lp151.3.33.1
tomcat-docs-webapp-9.0.36-lp151.3.33.1
tomcat-el-3_0-api-9.0.36-lp151.3.33.1
tomcat-embed-9.0.36-lp151.3.33.1
tomcat-javadoc-9.0.36-lp151.3.33.1
tomcat-jsp-2_3-api-9.0.36-lp151.3.33.1
tomcat-jsvc-9.0.36-lp151.3.33.1
tomcat-lib-9.0.36-lp151.3.33.1
tomcat-servlet-4_0-api-9.0.36-lp151.3.33.1
tomcat-webapps-9.0.36-lp151.3.33.1

Ссылки

Описание

If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This could lead to users seeing responses for unexpected resources.

Затронутые продукты
openSUSE Leap 15.1:tomcat-9.0.36-lp151.3.33.1
openSUSE Leap 15.1:tomcat-admin-webapps-9.0.36-lp151.3.33.1
openSUSE Leap 15.1:tomcat-docs-webapp-9.0.36-lp151.3.33.1
openSUSE Leap 15.1:tomcat-el-3_0-api-9.0.36-lp151.3.33.1
Ссылки