cve-2020-13943
Vulnerability from cvelistv5
Published
2020-10-12 13:46
Modified
2024-08-04 12:32
Severity ?
Summary
If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This could lead to users seeing responses for unexpected resources.
References
security@apache.orghttp://lists.opensuse.org/opensuse-security-announce/2020-11/msg00002.htmlMailing List, Third Party Advisory
security@apache.orghttp://lists.opensuse.org/opensuse-security-announce/2020-11/msg00021.htmlBroken Link
security@apache.orghttps://lists.apache.org/thread.html/r4a390027eb27e4550142fac6c8317cc684b157ae314d31514747f307%40%3Cannounce.tomcat.apache.org%3EVendor Advisory
security@apache.orghttps://lists.debian.org/debian-lts-announce/2020/10/msg00019.htmlThird Party Advisory
security@apache.orghttps://security.netapp.com/advisory/ntap-20201016-0007/Third Party Advisory
security@apache.orghttps://www.debian.org/security/2021/dsa-4835Third Party Advisory
security@apache.orghttps://www.oracle.com/security-alerts/cpuApr2021.htmlPatch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00002.htmlMailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00021.htmlBroken Link
af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/r4a390027eb27e4550142fac6c8317cc684b157ae314d31514747f307%40%3Cannounce.tomcat.apache.org%3EVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://lists.debian.org/debian-lts-announce/2020/10/msg00019.htmlThird Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20201016-0007/Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.debian.org/security/2021/dsa-4835Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com/security-alerts/cpuApr2021.htmlPatch, Third Party Advisory
Impacted products
Vendor Product Version
n/a Apache Tomcat Version: Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37, 8.5.0 to 8.5.57
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T12:32:14.470Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r4a390027eb27e4550142fac6c8317cc684b157ae314d31514747f307%40%3Cannounce.tomcat.apache.org%3E",
               },
               {
                  name: "[debian-lts-announce] 20201014 [SECURITY] [DLA 2407-1] tomcat8 security update",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2020/10/msg00019.html",
               },
               {
                  name: "openSUSE-SU-2020:1799",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00002.html",
               },
               {
                  name: "openSUSE-SU-2020:1842",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00021.html",
               },
               {
                  name: "DSA-4835",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_DEBIAN",
                     "x_transferred",
                  ],
                  url: "https://www.debian.org/security/2021/dsa-4835",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpuApr2021.html",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20201016-0007/",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "Apache Tomcat",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37, 8.5.0 to 8.5.57",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This could lead to users seeing responses for unexpected resources.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "Information Disclosure",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2021-06-14T17:20:16",
            orgId: "f0158376-9dc2-43b6-827c-5f631a4d8d09",
            shortName: "apache",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://lists.apache.org/thread.html/r4a390027eb27e4550142fac6c8317cc684b157ae314d31514747f307%40%3Cannounce.tomcat.apache.org%3E",
            },
            {
               name: "[debian-lts-announce] 20201014 [SECURITY] [DLA 2407-1] tomcat8 security update",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2020/10/msg00019.html",
            },
            {
               name: "openSUSE-SU-2020:1799",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00002.html",
            },
            {
               name: "openSUSE-SU-2020:1842",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00021.html",
            },
            {
               name: "DSA-4835",
               tags: [
                  "vendor-advisory",
                  "x_refsource_DEBIAN",
               ],
               url: "https://www.debian.org/security/2021/dsa-4835",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com/security-alerts/cpuApr2021.html",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://security.netapp.com/advisory/ntap-20201016-0007/",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "security@apache.org",
               ID: "CVE-2020-13943",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "Apache Tomcat",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37, 8.5.0 to 8.5.57",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This could lead to users seeing responses for unexpected resources.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "Information Disclosure",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://lists.apache.org/thread.html/r4a390027eb27e4550142fac6c8317cc684b157ae314d31514747f307%40%3Cannounce.tomcat.apache.org%3E",
                     refsource: "MISC",
                     url: "https://lists.apache.org/thread.html/r4a390027eb27e4550142fac6c8317cc684b157ae314d31514747f307%40%3Cannounce.tomcat.apache.org%3E",
                  },
                  {
                     name: "[debian-lts-announce] 20201014 [SECURITY] [DLA 2407-1] tomcat8 security update",
                     refsource: "MLIST",
                     url: "https://lists.debian.org/debian-lts-announce/2020/10/msg00019.html",
                  },
                  {
                     name: "openSUSE-SU-2020:1799",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00002.html",
                  },
                  {
                     name: "openSUSE-SU-2020:1842",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00021.html",
                  },
                  {
                     name: "DSA-4835",
                     refsource: "DEBIAN",
                     url: "https://www.debian.org/security/2021/dsa-4835",
                  },
                  {
                     name: "https://www.oracle.com/security-alerts/cpuApr2021.html",
                     refsource: "MISC",
                     url: "https://www.oracle.com/security-alerts/cpuApr2021.html",
                  },
                  {
                     name: "https://security.netapp.com/advisory/ntap-20201016-0007/",
                     refsource: "CONFIRM",
                     url: "https://security.netapp.com/advisory/ntap-20201016-0007/",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "f0158376-9dc2-43b6-827c-5f631a4d8d09",
      assignerShortName: "apache",
      cveId: "CVE-2020-13943",
      datePublished: "2020-10-12T13:46:47",
      dateReserved: "2020-06-08T00:00:00",
      dateUpdated: "2024-08-04T12:32:14.470Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
   "vulnerability-lookup:meta": {
      fkie_nvd: {
         configurations: "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:8.5.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"69A7FC28-A0EC-4516-9776-700343D2F4DB\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:8.5.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"18814653-6D44-47D9-A2F5-89C5AFB255F8\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:8.5.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"D4D811A9-4988-4C11-AA27-F5BE2B93D8D4\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:8.5.3:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"FAEF824D-7E95-4BC1-8DBB-787DCE595E21\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:8.5.4:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"97F4A2B3-DB1D-4D0B-B5FF-7EE2A0D291BB\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:8.5.5:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"0B461D5A-1208-498F-B551-46C6D514AC2B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:8.5.6:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"598E5D91-0165-4D55-9EDD-EBB5AAAD1172\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:8.5.7:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"4B6B61B7-09A3-41C8-8333-0417C14CC87E\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:8.5.8:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"95A139BA-CD3C-42F5-88BA-BE7BE58246D7\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:8.5.9:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"876EADA5-60AD-4849-BE10-61C75AA75053\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:8.5.10:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"1814F8DE-2060-411F-9FCC-6EC42AF5663D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:8.5.11:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"1AF6DBF7-BB0A-4AE6-84DA-51428ACF47CD\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:8.5.12:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"A34F72ED-04FE-4EDE-BB18-BE8B1E99EEF1\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:8.5.13:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"3245C35C-02E7-46B9-A720-37D3C17AFDD4\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:8.5.14:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"F4239A72-EFA1-49E3-8755-5961060F2198\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:8.5.15:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"C9053CCE-1175-47F9-BF27-7586F082AF83\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:8.5.16:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"70D3EC47-945C-4B5A-B5B7-C14AE327AC2E\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:8.5.17:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"B723AFDD-0A51-43A1-AB0F-A529FF9B7889\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:8.5.18:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"7D2200BA-FFD0-411E-BFF4-D6C495F57FE6\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:8.5.19:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"00550F53-352F-40E5-A6EE-16BE28DD00AE\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:8.5.20:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"8D17F903-C184-4B33-97C9-FF4355C2847E\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:8.5.21:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"1E267CF3-397C-4844-91E7-D2550C33D9A3\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:8.5.22:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"394519F4-0F58-456E-A999-163992D9A918\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:8.5.23:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"0C6CCD68-88F1-46D5-AB18-67833E3FF5FA\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:8.5.24:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"ACCB8093-D873-4002-A5AE-355277A723CA\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:8.5.25:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"8CD61473-1BDD-4540-A86B-D632D015A580\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:8.5.26:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"D87B8D77-9245-4D7A-97A9-126E22280AC2\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:8.5.27:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"962A6252-DE4A-4F1C-A521-493D8F0893DC\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:8.5.28:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"33A3953F-E30A-457A-A70F-CE9880C9B90D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:8.5.29:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"31E349E2-15A4-4912-AE1E-6A87435820B5\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:8.5.30:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"5A2A0AAA-3466-4D26-AD39-1C4F593D9FDF\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:8.5.31:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"046CAC7B-4214-49C5-A386-D1AF240A5DF8\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:8.5.32:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"A880C043-F8FF-4944-9FAC-150BF03121D7\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:8.5.33:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"F9A7908B-BA6F-4B4A-848C-D97FF57A252B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:8.5.34:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"048A0A60-AC69-4817-AD50-63BF81D446D2\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:8.5.35:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"4C1361C3-24D6-4697-B9D5-555EB5CF0451\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:8.5.36:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"A30D4E8D-2293-473E-88B1-FB2C71E46D76\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:8.5.37:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"A6A910D4-9EC9-4D7E-AE15-C3F4D96321A4\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:8.5.38:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"DC3A3FA5-7F1B-4440-A85A-F3E791FE19C9\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:8.5.39:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"C0C107D4-6A4F-4CC8-8406-EB18D9BD7DD7\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:8.5.40:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"AA489EF3-71D2-46DD-BB22-7F25688152E5\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:8.5.41:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"DF53B9F3-1E1A-4C95-921C-4F9836B89A89\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:8.5.42:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"3586242F-DCEB-4840-A0D8-E2DD0A6C4E01\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:8.5.43:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"1CAE6BEA-21B0-434F-B035-B1FDB6331BE0\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:8.5.44:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"C44B9431-967F-495A-B36E-AD971369CD90\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:8.5.45:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"0B27860E-6F36-4C98-B818-CBB8F1697DDA\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:8.5.46:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"9C3D3F12-8F04-45A3-AE22-D874A7B3DE69\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:8.5.47:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"4720C3C9-3420-4521-A332-BA212A6F6596\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:8.5.48:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"9642D59E-9AB9-4D53-8833-EBFE1881BEDA\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:8.5.49:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"DEA04289-8940-4B66-AD9A-257D8A1FA0A3\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:8.5.50:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"029598EB-C89A-41F6-B4CE-3D9ED838A2D9\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:8.5.51:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"10539698-A88B-40D0-B8BC-B4CE2E608AD1\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:8.5.52:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"B11E81D7-B260-4CA7-B7C3-DF388B02175F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:8.5.53:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"CB6D6B17-7FA6-43C0-9FF4-5F649280AD79\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:8.5.54:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"83AC9644-97E7-47F9-8C6A-7F675B7FFDC9\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:8.5.55:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"EB71B43A-F838-47A3-99DB-02B92574678A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:8.5.56:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"879D56E7-241E-4EB1-ACD4-137E59F862AF\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:8.5.57:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"E99BB895-7A73-4326-89B3-77B770F4D1E4\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:9.0.0:milestone10:*:*:*:*:*:*\", \"matchCriteriaId\": \"89B129B2-FB6F-4EF9-BF12-E589A87996CF\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:9.0.0:milestone11:*:*:*:*:*:*\", \"matchCriteriaId\": \"8B6787B6-54A8-475E-BA1C-AB99334B2535\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:9.0.0:milestone12:*:*:*:*:*:*\", \"matchCriteriaId\": \"EABB6FBC-7486-44D5-A6AD-FFF1D3F677E1\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:9.0.0:milestone13:*:*:*:*:*:*\", \"matchCriteriaId\": \"E10C03BC-EE6B-45B2-83AE-9E8DFB58D7DB\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:9.0.0:milestone14:*:*:*:*:*:*\", \"matchCriteriaId\": \"8A6DA0BE-908C-4DA8-A191-A0113235E99A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:9.0.0:milestone15:*:*:*:*:*:*\", \"matchCriteriaId\": \"39029C72-28B4-46A4-BFF5-EC822CFB2A4C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:9.0.0:milestone16:*:*:*:*:*:*\", \"matchCriteriaId\": \"1A2E05A3-014F-4C4D-81E5-88E725FBD6AD\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:9.0.0:milestone17:*:*:*:*:*:*\", \"matchCriteriaId\": \"166C533C-0833-41D5-99B6-17A4FAB3CAF0\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:9.0.0:milestone18:*:*:*:*:*:*\", \"matchCriteriaId\": \"D3768C60-21FA-4B92-B98C-C3A2602D1BC4\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:9.0.0:milestone19:*:*:*:*:*:*\", \"matchCriteriaId\": \"DDD510FA-A2E4-4BAF-A0DE-F4E5777E9325\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:9.0.0:milestone20:*:*:*:*:*:*\", \"matchCriteriaId\": \"C2409CC7-6A85-4A66-A457-0D62B9895DC1\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:9.0.0:milestone21:*:*:*:*:*:*\", \"matchCriteriaId\": \"B392A7E5-4455-4B1C-8FAC-AE6DDC70689E\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:9.0.0:milestone22:*:*:*:*:*:*\", \"matchCriteriaId\": \"EF411DDA-2601-449A-9046-D250419A0E1A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:9.0.0:milestone23:*:*:*:*:*:*\", \"matchCriteriaId\": \"D7D8F2F4-AFE2-47EA-A3FD-79B54324DE02\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:9.0.0:milestone24:*:*:*:*:*:*\", \"matchCriteriaId\": \"1B4FBF97-DE16-4E5E-BE19-471E01818D40\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:9.0.0:milestone25:*:*:*:*:*:*\", \"matchCriteriaId\": \"3B266B1E-24B5-47EE-A421-E0E3CC0C7471\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:9.0.0:milestone26:*:*:*:*:*:*\", \"matchCriteriaId\": \"29614C3A-6FB3-41C7-B56E-9CC3F45B04F0\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:9.0.0:milestone27:*:*:*:*:*:*\", \"matchCriteriaId\": \"C6AB156C-8FF6-4727-AF75-590D0DCB3F9D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:9.0.0:milestone5:*:*:*:*:*:*\", \"matchCriteriaId\": \"49AAF4DF-F61D-47A8-8788-A21E317A145D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:9.0.0:milestone6:*:*:*:*:*:*\", \"matchCriteriaId\": \"454211D0-60A2-4661-AECA-4C0121413FEB\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:9.0.0:milestone7:*:*:*:*:*:*\", \"matchCriteriaId\": \"0686F977-889F-4960-8E0B-7784B73A7F2D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:9.0.0:milestone8:*:*:*:*:*:*\", \"matchCriteriaId\": \"558703AE-DB5E-4DFF-B497-C36694DD7B24\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:9.0.0:milestone9:*:*:*:*:*:*\", \"matchCriteriaId\": \"ED6273F2-1165-47A4-8DD7-9E9B2472941B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:9.0.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"A4355F36-B223-4819-8272-751EBB68782F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:9.0.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"E5962DD4-006E-42F3-A0B0-A1787C0E9384\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:9.0.3:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"6B0D2EE9-1220-4A81-93E6-97FFD3960CFC\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:9.0.4:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"2F4ABA66-A344-43F1-98A0-4CD5D8728F0F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:9.0.5:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"3AC22738-4B74-4EE5-8B13-50D8A4997B37\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:9.0.6:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"7C2A8AF6-D725-4244-B866-E20F228BBAD1\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:9.0.7:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"45978B9B-95B5-47F9-9332-CACCFDFEABD0\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:9.0.8:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"6D017BA3-6495-43EC-9670-475081DE3548\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:9.0.9:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"2EE8A916-AD03-485F-AB4A-FC121A3F8E28\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:9.0.10:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"7F4FF034-1FA4-4393-8B45-75C32819E10E\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:9.0.11:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"743E0EFB-F2B3-4C9A-AD7E-AB157135DCA3\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:9.0.12:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"0F0377FB-9C66-4CA7-A418-0BBB26BE5CC0\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:9.0.13:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"10D018EE-9780-4976-9461-C2B45F3EF835\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:9.0.14:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"F4A94099-DEEC-44BE-9CEB-229F69018A42\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:9.0.15:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"536CD6F1-EA2B-40B1-A179-06C7BD701435\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:9.0.16:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"FB533E0D-4ABE-4778-B546-90CE2543BB82\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:9.0.17:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"556FE8EE-C73C-49E4-8E7F-4C033BB1230F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:9.0.18:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"C4EE9ED2-BA38-4C91-9EC2-02F972335354\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:9.0.19:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"C3385F07-0D52-494F-BA3E-38D747654363\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:9.0.20:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"0D13E0C5-7438-4445-A420-1713C0512D53\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:9.0.21:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"F403DCBB-7E1F-4D61-BE9A-CA61AC2A7CF9\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:9.0.22:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"A78D7E11-D5D4-4F41-9220-B2093FEC9A85\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:9.0.23:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"4D97FF00-EFAF-4663-9653-9A922C7A27CE\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:9.0.24:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"C5129FB1-7972-46C1-AFDF-B42E94257750\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:9.0.25:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"7BF9B8DF-D408-4CC1-98C9-DF19E746A5F1\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:9.0.26:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"CC72E8A5-1187-4127-9162-9E003B0043C7\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:9.0.27:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"A2DADCAB-DB66-49A8-9932-E004347A87D2\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:9.0.28:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"D0533743-6F28-48CB-94B0-F8E1BF023909\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:9.0.29:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"CED05E4E-FD16-4F3C-A82A-92C94B143986\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:9.0.30:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"7A20C09D-79FB-4F7C-A56D-D10E76F432C5\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:9.0.31:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"74CB0853-920E-4CBC-B2C0-017E769424CB\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:9.0.32:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"FC53AE53-D872-4943-85B3-0E5D23A20A68\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:9.0.33:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"1938D623-92F0-4C4B-9AF7-C822A8ED7D81\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:9.0.34:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"66AD3F53-98FA-40B5-9B4F-55F3D6C35B96\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:9.0.35:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"F0CD6C44-4E62-41FC-8E2F-C02A0CF10D6B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:9.0.36:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"236DC804-3275-4395-BFAA-260E66AB752B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:9.0.37:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"41F32E7D-12E8-4EC9-A504-7CA293CC8821\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:10.0.0:milestone1:*:*:*:*:*:*\", \"matchCriteriaId\": \"90CD7E85-4FF9-4158-AC78-4BFCBC882A65\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:10.0.0:milestone2:*:*:*:*:*:*\", \"matchCriteriaId\": \"7EA56B52-1015-40CD-B10C-393768094269\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:10.0.0:milestone3:*:*:*:*:*:*\", \"matchCriteriaId\": \"501B0D4A-D636-4736-979B-D5023599CEFB\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:10.0.0:milestone4:*:*:*:*:*:*\", \"matchCriteriaId\": \"94E7764F-BF9E-463E-B446-A9A8DB92BB97\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:10.0.0:milestone5:*:*:*:*:*:*\", \"matchCriteriaId\": \"53A9F7EE-AF2A-43E5-B708-0198784AB45A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:10.0.0:milestone6:*:*:*:*:*:*\", \"matchCriteriaId\": \"AC872C5F-63AF-4BB8-8629-334FC9704AE8\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:tomcat:10.0.0:milestone7:*:*:*:*:*:*\", \"matchCriteriaId\": \"94B95C95-DF3E-49C1-9CA0-4474DD7EF7B8\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"DEECE5FC-CACF-4496-A3E7-164736409252\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"07B237A9-69A3-4A9C-9DA0-4E06BD37AE73\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:instantis_enterprisetrack:17.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"82EA4BA7-C38B-4AF3-8914-9E3D089EBDD4\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:instantis_enterprisetrack:17.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"B9C9BC66-FA5F-4774-9BDA-7AB88E2839C4\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:instantis_enterprisetrack:17.3:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"7F69B9A5-F21B-4904-9F27-95C0F7A628E3\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:sd-wan_edge:9.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"77E39D5C-5EFA-4FEB-909E-0A92004F2563\"}]}]}]",
         descriptions: "[{\"lang\": \"en\", \"value\": \"If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This could lead to users seeing responses for unexpected resources.\"}, {\"lang\": \"es\", \"value\": \"Si un cliente HTTP/2 conectado a Apache Tomcat versiones 10.0.0-M1 hasta 10.0.0-M7, versiones 9.0.0.M1 hasta 9.0.37 o versiones 8.5.0 hasta 8.5.57, excedi\\u00f3 el n\\u00famero m\\u00e1ximo acordado de transmisiones simult\\u00e1neas para una conexi\\u00f3n (en violaci\\u00f3n del protocolo HTTP/2), era posible que una petici\\u00f3n subsiguiente realizada en esa conexi\\u00f3n pudiera contener encabezados HTTP, incluyendo los pseudo encabezados HTTP/2, de una petici\\u00f3n anterior en lugar de los encabezados previstos. Esto podr\\u00eda conllevar que los usuarios visualicen respuestas para recursos inesperados\"}]",
         id: "CVE-2020-13943",
         lastModified: "2024-11-21T05:02:11.967",
         metrics: "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N\", \"baseScore\": 4.3, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"LOW\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 2.8, \"impactScore\": 1.4}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:L/Au:S/C:P/I:N/A:N\", \"baseScore\": 4.0, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"LOW\", \"authentication\": \"SINGLE\", \"confidentialityImpact\": \"PARTIAL\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"baseSeverity\": \"MEDIUM\", \"exploitabilityScore\": 8.0, \"impactScore\": 2.9, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}",
         published: "2020-10-12T14:15:12.183",
         references: "[{\"url\": \"http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00002.html\", \"source\": \"security@apache.org\", \"tags\": [\"Mailing List\", \"Third Party Advisory\"]}, {\"url\": \"http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00021.html\", \"source\": \"security@apache.org\", \"tags\": [\"Broken Link\"]}, {\"url\": \"https://lists.apache.org/thread.html/r4a390027eb27e4550142fac6c8317cc684b157ae314d31514747f307%40%3Cannounce.tomcat.apache.org%3E\", \"source\": \"security@apache.org\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2020/10/msg00019.html\", \"source\": \"security@apache.org\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://security.netapp.com/advisory/ntap-20201016-0007/\", \"source\": \"security@apache.org\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://www.debian.org/security/2021/dsa-4835\", \"source\": \"security@apache.org\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://www.oracle.com/security-alerts/cpuApr2021.html\", \"source\": \"security@apache.org\", \"tags\": [\"Patch\", \"Third Party Advisory\"]}, {\"url\": \"http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00002.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mailing List\", \"Third Party Advisory\"]}, {\"url\": \"http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00021.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Broken Link\"]}, {\"url\": \"https://lists.apache.org/thread.html/r4a390027eb27e4550142fac6c8317cc684b157ae314d31514747f307%40%3Cannounce.tomcat.apache.org%3E\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2020/10/msg00019.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://security.netapp.com/advisory/ntap-20201016-0007/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://www.debian.org/security/2021/dsa-4835\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://www.oracle.com/security-alerts/cpuApr2021.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\", \"Third Party Advisory\"]}]",
         sourceIdentifier: "security@apache.org",
         vulnStatus: "Modified",
         weaknesses: "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"NVD-CWE-noinfo\"}]}]",
      },
      nvd: "{\"cve\":{\"id\":\"CVE-2020-13943\",\"sourceIdentifier\":\"security@apache.org\",\"published\":\"2020-10-12T14:15:12.183\",\"lastModified\":\"2024-11-21T05:02:11.967\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This could lead to users seeing responses for unexpected resources.\"},{\"lang\":\"es\",\"value\":\"Si un cliente HTTP/2 conectado a Apache Tomcat versiones 10.0.0-M1 hasta 10.0.0-M7, versiones 9.0.0.M1 hasta 9.0.37 o versiones 8.5.0 hasta 8.5.57, excedió el número máximo acordado de transmisiones simultáneas para una conexión (en violación del protocolo HTTP/2), era posible que una petición subsiguiente realizada en esa conexión pudiera contener encabezados HTTP, incluyendo los pseudo encabezados HTTP/2, de una petición anterior en lugar de los encabezados previstos. Esto podría conllevar que los usuarios visualicen respuestas para recursos inesperados\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N\",\"baseScore\":4.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":1.4}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:S/C:P/I:N/A:N\",\"baseScore\":4.0,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"SINGLE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.0,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.5.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"69A7FC28-A0EC-4516-9776-700343D2F4DB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.5.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"18814653-6D44-47D9-A2F5-89C5AFB255F8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.5.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D4D811A9-4988-4C11-AA27-F5BE2B93D8D4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.5.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FAEF824D-7E95-4BC1-8DBB-787DCE595E21\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.5.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"97F4A2B3-DB1D-4D0B-B5FF-7EE2A0D291BB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.5.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0B461D5A-1208-498F-B551-46C6D514AC2B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.5.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"598E5D91-0165-4D55-9EDD-EBB5AAAD1172\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.5.7:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4B6B61B7-09A3-41C8-8333-0417C14CC87E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.5.8:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"95A139BA-CD3C-42F5-88BA-BE7BE58246D7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.5.9:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"876EADA5-60AD-4849-BE10-61C75AA75053\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.5.10:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1814F8DE-2060-411F-9FCC-6EC42AF5663D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.5.11:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1AF6DBF7-BB0A-4AE6-84DA-51428ACF47CD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.5.12:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A34F72ED-04FE-4EDE-BB18-BE8B1E99EEF1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.5.13:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3245C35C-02E7-46B9-A720-37D3C17AFDD4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.5.14:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F4239A72-EFA1-49E3-8755-5961060F2198\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.5.15:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C9053CCE-1175-47F9-BF27-7586F082AF83\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.5.16:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"70D3EC47-945C-4B5A-B5B7-C14AE327AC2E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.5.17:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B723AFDD-0A51-43A1-AB0F-A529FF9B7889\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.5.18:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7D2200BA-FFD0-411E-BFF4-D6C495F57FE6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.5.19:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"00550F53-352F-40E5-A6EE-16BE28DD00AE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.5.20:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8D17F903-C184-4B33-97C9-FF4355C2847E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.5.21:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1E267CF3-397C-4844-91E7-D2550C33D9A3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.5.22:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"394519F4-0F58-456E-A999-163992D9A918\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.5.23:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0C6CCD68-88F1-46D5-AB18-67833E3FF5FA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.5.24:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"ACCB8093-D873-4002-A5AE-355277A723CA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.5.25:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8CD61473-1BDD-4540-A86B-D632D015A580\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.5.26:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D87B8D77-9245-4D7A-97A9-126E22280AC2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.5.27:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"962A6252-DE4A-4F1C-A521-493D8F0893DC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.5.28:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"33A3953F-E30A-457A-A70F-CE9880C9B90D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.5.29:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"31E349E2-15A4-4912-AE1E-6A87435820B5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.5.30:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5A2A0AAA-3466-4D26-AD39-1C4F593D9FDF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.5.31:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"046CAC7B-4214-49C5-A386-D1AF240A5DF8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.5.32:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A880C043-F8FF-4944-9FAC-150BF03121D7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.5.33:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F9A7908B-BA6F-4B4A-848C-D97FF57A252B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.5.34:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"048A0A60-AC69-4817-AD50-63BF81D446D2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.5.35:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4C1361C3-24D6-4697-B9D5-555EB5CF0451\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.5.36:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A30D4E8D-2293-473E-88B1-FB2C71E46D76\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.5.37:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A6A910D4-9EC9-4D7E-AE15-C3F4D96321A4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.5.38:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DC3A3FA5-7F1B-4440-A85A-F3E791FE19C9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.5.39:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C0C107D4-6A4F-4CC8-8406-EB18D9BD7DD7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.5.40:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"AA489EF3-71D2-46DD-BB22-7F25688152E5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.5.41:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DF53B9F3-1E1A-4C95-921C-4F9836B89A89\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.5.42:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3586242F-DCEB-4840-A0D8-E2DD0A6C4E01\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.5.43:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1CAE6BEA-21B0-434F-B035-B1FDB6331BE0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.5.44:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C44B9431-967F-495A-B36E-AD971369CD90\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.5.45:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0B27860E-6F36-4C98-B818-CBB8F1697DDA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.5.46:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9C3D3F12-8F04-45A3-AE22-D874A7B3DE69\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.5.47:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4720C3C9-3420-4521-A332-BA212A6F6596\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.5.48:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9642D59E-9AB9-4D53-8833-EBFE1881BEDA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.5.49:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DEA04289-8940-4B66-AD9A-257D8A1FA0A3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.5.50:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"029598EB-C89A-41F6-B4CE-3D9ED838A2D9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.5.51:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"10539698-A88B-40D0-B8BC-B4CE2E608AD1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.5.52:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B11E81D7-B260-4CA7-B7C3-DF388B02175F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.5.53:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CB6D6B17-7FA6-43C0-9FF4-5F649280AD79\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.5.54:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"83AC9644-97E7-47F9-8C6A-7F675B7FFDC9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.5.55:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"EB71B43A-F838-47A3-99DB-02B92574678A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.5.56:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"879D56E7-241E-4EB1-ACD4-137E59F862AF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:8.5.57:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E99BB895-7A73-4326-89B3-77B770F4D1E4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.0:milestone10:*:*:*:*:*:*\",\"matchCriteriaId\":\"89B129B2-FB6F-4EF9-BF12-E589A87996CF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.0:milestone11:*:*:*:*:*:*\",\"matchCriteriaId\":\"8B6787B6-54A8-475E-BA1C-AB99334B2535\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.0:milestone12:*:*:*:*:*:*\",\"matchCriteriaId\":\"EABB6FBC-7486-44D5-A6AD-FFF1D3F677E1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.0:milestone13:*:*:*:*:*:*\",\"matchCriteriaId\":\"E10C03BC-EE6B-45B2-83AE-9E8DFB58D7DB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.0:milestone14:*:*:*:*:*:*\",\"matchCriteriaId\":\"8A6DA0BE-908C-4DA8-A191-A0113235E99A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.0:milestone15:*:*:*:*:*:*\",\"matchCriteriaId\":\"39029C72-28B4-46A4-BFF5-EC822CFB2A4C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.0:milestone16:*:*:*:*:*:*\",\"matchCriteriaId\":\"1A2E05A3-014F-4C4D-81E5-88E725FBD6AD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.0:milestone17:*:*:*:*:*:*\",\"matchCriteriaId\":\"166C533C-0833-41D5-99B6-17A4FAB3CAF0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.0:milestone18:*:*:*:*:*:*\",\"matchCriteriaId\":\"D3768C60-21FA-4B92-B98C-C3A2602D1BC4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.0:milestone19:*:*:*:*:*:*\",\"matchCriteriaId\":\"DDD510FA-A2E4-4BAF-A0DE-F4E5777E9325\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.0:milestone20:*:*:*:*:*:*\",\"matchCriteriaId\":\"C2409CC7-6A85-4A66-A457-0D62B9895DC1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.0:milestone21:*:*:*:*:*:*\",\"matchCriteriaId\":\"B392A7E5-4455-4B1C-8FAC-AE6DDC70689E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.0:milestone22:*:*:*:*:*:*\",\"matchCriteriaId\":\"EF411DDA-2601-449A-9046-D250419A0E1A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.0:milestone23:*:*:*:*:*:*\",\"matchCriteriaId\":\"D7D8F2F4-AFE2-47EA-A3FD-79B54324DE02\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.0:milestone24:*:*:*:*:*:*\",\"matchCriteriaId\":\"1B4FBF97-DE16-4E5E-BE19-471E01818D40\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.0:milestone25:*:*:*:*:*:*\",\"matchCriteriaId\":\"3B266B1E-24B5-47EE-A421-E0E3CC0C7471\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.0:milestone26:*:*:*:*:*:*\",\"matchCriteriaId\":\"29614C3A-6FB3-41C7-B56E-9CC3F45B04F0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.0:milestone27:*:*:*:*:*:*\",\"matchCriteriaId\":\"C6AB156C-8FF6-4727-AF75-590D0DCB3F9D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.0:milestone5:*:*:*:*:*:*\",\"matchCriteriaId\":\"49AAF4DF-F61D-47A8-8788-A21E317A145D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.0:milestone6:*:*:*:*:*:*\",\"matchCriteriaId\":\"454211D0-60A2-4661-AECA-4C0121413FEB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.0:milestone7:*:*:*:*:*:*\",\"matchCriteriaId\":\"0686F977-889F-4960-8E0B-7784B73A7F2D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.0:milestone8:*:*:*:*:*:*\",\"matchCriteriaId\":\"558703AE-DB5E-4DFF-B497-C36694DD7B24\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.0:milestone9:*:*:*:*:*:*\",\"matchCriteriaId\":\"ED6273F2-1165-47A4-8DD7-9E9B2472941B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A4355F36-B223-4819-8272-751EBB68782F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E5962DD4-006E-42F3-A0B0-A1787C0E9384\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6B0D2EE9-1220-4A81-93E6-97FFD3960CFC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2F4ABA66-A344-43F1-98A0-4CD5D8728F0F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3AC22738-4B74-4EE5-8B13-50D8A4997B37\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7C2A8AF6-D725-4244-B866-E20F228BBAD1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.7:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"45978B9B-95B5-47F9-9332-CACCFDFEABD0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.8:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6D017BA3-6495-43EC-9670-475081DE3548\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.9:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2EE8A916-AD03-485F-AB4A-FC121A3F8E28\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.10:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7F4FF034-1FA4-4393-8B45-75C32819E10E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.11:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"743E0EFB-F2B3-4C9A-AD7E-AB157135DCA3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.12:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0F0377FB-9C66-4CA7-A418-0BBB26BE5CC0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.13:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"10D018EE-9780-4976-9461-C2B45F3EF835\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.14:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F4A94099-DEEC-44BE-9CEB-229F69018A42\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.15:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"536CD6F1-EA2B-40B1-A179-06C7BD701435\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.16:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FB533E0D-4ABE-4778-B546-90CE2543BB82\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.17:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"556FE8EE-C73C-49E4-8E7F-4C033BB1230F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.18:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C4EE9ED2-BA38-4C91-9EC2-02F972335354\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.19:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C3385F07-0D52-494F-BA3E-38D747654363\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.20:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0D13E0C5-7438-4445-A420-1713C0512D53\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.21:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F403DCBB-7E1F-4D61-BE9A-CA61AC2A7CF9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.22:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A78D7E11-D5D4-4F41-9220-B2093FEC9A85\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.23:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4D97FF00-EFAF-4663-9653-9A922C7A27CE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.24:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C5129FB1-7972-46C1-AFDF-B42E94257750\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.25:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7BF9B8DF-D408-4CC1-98C9-DF19E746A5F1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.26:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CC72E8A5-1187-4127-9162-9E003B0043C7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.27:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A2DADCAB-DB66-49A8-9932-E004347A87D2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.28:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D0533743-6F28-48CB-94B0-F8E1BF023909\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.29:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CED05E4E-FD16-4F3C-A82A-92C94B143986\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.30:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7A20C09D-79FB-4F7C-A56D-D10E76F432C5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.31:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"74CB0853-920E-4CBC-B2C0-017E769424CB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.32:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FC53AE53-D872-4943-85B3-0E5D23A20A68\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.33:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1938D623-92F0-4C4B-9AF7-C822A8ED7D81\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.34:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"66AD3F53-98FA-40B5-9B4F-55F3D6C35B96\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.35:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F0CD6C44-4E62-41FC-8E2F-C02A0CF10D6B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.36:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"236DC804-3275-4395-BFAA-260E66AB752B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:9.0.37:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"41F32E7D-12E8-4EC9-A504-7CA293CC8821\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:10.0.0:milestone1:*:*:*:*:*:*\",\"matchCriteriaId\":\"90CD7E85-4FF9-4158-AC78-4BFCBC882A65\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:10.0.0:milestone2:*:*:*:*:*:*\",\"matchCriteriaId\":\"7EA56B52-1015-40CD-B10C-393768094269\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:10.0.0:milestone3:*:*:*:*:*:*\",\"matchCriteriaId\":\"501B0D4A-D636-4736-979B-D5023599CEFB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:10.0.0:milestone4:*:*:*:*:*:*\",\"matchCriteriaId\":\"94E7764F-BF9E-463E-B446-A9A8DB92BB97\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:10.0.0:milestone5:*:*:*:*:*:*\",\"matchCriteriaId\":\"53A9F7EE-AF2A-43E5-B708-0198784AB45A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:10.0.0:milestone6:*:*:*:*:*:*\",\"matchCriteriaId\":\"AC872C5F-63AF-4BB8-8629-334FC9704AE8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:tomcat:10.0.0:milestone7:*:*:*:*:*:*\",\"matchCriteriaId\":\"94B95C95-DF3E-49C1-9CA0-4474DD7EF7B8\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DEECE5FC-CACF-4496-A3E7-164736409252\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"07B237A9-69A3-4A9C-9DA0-4E06BD37AE73\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:instantis_enterprisetrack:17.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"82EA4BA7-C38B-4AF3-8914-9E3D089EBDD4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:instantis_enterprisetrack:17.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B9C9BC66-FA5F-4774-9BDA-7AB88E2839C4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:instantis_enterprisetrack:17.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7F69B9A5-F21B-4904-9F27-95C0F7A628E3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:sd-wan_edge:9.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"77E39D5C-5EFA-4FEB-909E-0A92004F2563\"}]}]}],\"references\":[{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00002.html\",\"source\":\"security@apache.org\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00021.html\",\"source\":\"security@apache.org\",\"tags\":[\"Broken Link\"]},{\"url\":\"https://lists.apache.org/thread.html/r4a390027eb27e4550142fac6c8317cc684b157ae314d31514747f307%40%3Cannounce.tomcat.apache.org%3E\",\"source\":\"security@apache.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2020/10/msg00019.html\",\"source\":\"security@apache.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://security.netapp.com/advisory/ntap-20201016-0007/\",\"source\":\"security@apache.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.debian.org/security/2021/dsa-4835\",\"source\":\"security@apache.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.oracle.com/security-alerts/cpuApr2021.html\",\"source\":\"security@apache.org\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00002.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00021.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Broken Link\"]},{\"url\":\"https://lists.apache.org/thread.html/r4a390027eb27e4550142fac6c8317cc684b157ae314d31514747f307%40%3Cannounce.tomcat.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2020/10/msg00019.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://security.netapp.com/advisory/ntap-20201016-0007/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.debian.org/security/2021/dsa-4835\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.oracle.com/security-alerts/cpuApr2021.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\"]}]}}",
   },
}


Log in or create an account to share your comment.

Security Advisory comment format.

This schema specifies the format of a comment related to a security advisory.

UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).



Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.