{
   GSD: {
      alias: "CVE-2020-17527",
      description: "While investigating bug 64830 it was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request header value from the previous stream received on an HTTP/2 connection for the request associated with the subsequent stream. While this would most likely lead to an error and the closure of the HTTP/2 connection, it is possible that information could leak between requests.",
      id: "GSD-2020-17527",
      references: [
         "https://www.suse.com/security/cve/CVE-2020-17527.html",
         "https://www.debian.org/security/2021/dsa-4835",
         "https://access.redhat.com/errata/RHSA-2021:5134",
         "https://access.redhat.com/errata/RHSA-2021:4012",
         "https://access.redhat.com/errata/RHSA-2021:0495",
         "https://access.redhat.com/errata/RHSA-2021:0494",
         "https://advisories.mageia.org/CVE-2020-17527.html",
         "https://security.archlinux.org/CVE-2020-17527",
         "https://ubuntu.com/security/CVE-2020-17527",
         "https://alas.aws.amazon.com/cve/html/CVE-2020-17527.html",
      ],
   },
   gsd: {
      metadata: {
         exploitCode: "unknown",
         remediation: "unknown",
         reportConfidence: "confirmed",
         type: "vulnerability",
      },
      osvSchema: {
         aliases: [
            "CVE-2020-17527",
         ],
         details: "While investigating bug 64830 it was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request header value from the previous stream received on an HTTP/2 connection for the request associated with the subsequent stream. While this would most likely lead to an error and the closure of the HTTP/2 connection, it is possible that information could leak between requests.",
         id: "GSD-2020-17527",
         modified: "2023-12-13T01:21:50.290989Z",
         schema_version: "1.4.0",
      },
   },
   namespaces: {
      "cve.org": {
         CVE_data_meta: {
            ASSIGNER: "security@apache.org",
            ID: "CVE-2020-17527",
            STATE: "PUBLIC",
            TITLE: "Apache Tomcat: Request header mix-up between HTTP/2 streams",
         },
         affects: {
            vendor: {
               vendor_data: [
                  {
                     product: {
                        product_data: [
                           {
                              product_name: "Apache Tomcat",
                              version: {
                                 version_data: [
                                    {
                                       version_affected: "=",
                                       version_name: "Apache Tomcat 10",
                                       version_value: "10.0.0-M1 to 10.0.0-M9",
                                    },
                                    {
                                       version_affected: "=",
                                       version_name: "Apache Tomcat 9",
                                       version_value: "9.0.0-M1 to 9.0.39",
                                    },
                                    {
                                       version_affected: "=",
                                       version_name: "Apache Tomcat 8.5",
                                       version_value: "8.5.0 to 8.5.59",
                                    },
                                 ],
                              },
                           },
                        ],
                     },
                     vendor_name: "Apache Software Foundation",
                  },
               ],
            },
         },
         data_format: "MITRE",
         data_type: "CVE",
         data_version: "4.0",
         description: {
            description_data: [
               {
                  lang: "eng",
                  value: "While investigating bug 64830 it was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request header value from the previous stream received on an HTTP/2 connection for the request associated with the subsequent stream. While this would most likely lead to an error and the closure of the HTTP/2 connection, it is possible that information could leak between requests.",
               },
            ],
         },
         generator: {
            engine: "Vulnogram 0.0.9",
         },
         impact: {},
         problemtype: {
            problemtype_data: [
               {
                  description: [
                     {
                        lang: "eng",
                        value: "CWE-200 Information Exposure",
                     },
                  ],
               },
            ],
         },
         references: {
            reference_data: [
               {
                  name: "https://lists.apache.org/thread.html/rce5ac9a40173651d540babce59f6f3825f12c6d4e886ba00823b11e5%40%3Cannounce.tomcat.apache.org%3E",
                  refsource: "MISC",
                  url: "https://lists.apache.org/thread.html/rce5ac9a40173651d540babce59f6f3825f12c6d4e886ba00823b11e5%40%3Cannounce.tomcat.apache.org%3E",
               },
               {
                  name: "[tomcat-dev] 20201203 [SECURITY] CVE-2020-17527 Apache Tomcat HTTP/2 Request header mix-up",
                  refsource: "MLIST",
                  url: "https://lists.apache.org/thread.html/r8a227ac6a755a6406c1cc47dd48800e973d4cf13fe7fe68ac59c679c@%3Cdev.tomcat.apache.org%3E",
               },
               {
                  name: "[tomcat-dev] 20201203 svn commit: r1884073 - in /tomcat/site/trunk: docs/security-10.html docs/security-8.html docs/security-9.html xdocs/security-10.xml xdocs/security-8.xml xdocs/security-9.xml",
                  refsource: "MLIST",
                  url: "https://lists.apache.org/thread.html/raa0e9ad388c1e6fd1e301b5e080f9439f64cb4178119a86a4801cc53@%3Cdev.tomcat.apache.org%3E",
               },
               {
                  name: "[announce] 20201203 [SECURITY] CVE-2020-17527 Apache Tomcat HTTP/2 Request header mix-up",
                  refsource: "MLIST",
                  url: "https://lists.apache.org/thread.html/rce5ac9a40173651d540babce59f6f3825f12c6d4e886ba00823b11e5@%3Cannounce.apache.org%3E",
               },
               {
                  name: "[tomcat-users] 20201203 [SECURITY] CVE-2020-17527 Apache Tomcat HTTP/2 Request header mix-up",
                  refsource: "MLIST",
                  url: "https://lists.apache.org/thread.html/rd5babd13d7a350b369b2f647b4dd32ce678af42f9aba5389df1ae6ca@%3Cusers.tomcat.apache.org%3E",
               },
               {
                  name: "[tomcat-announce] 20201203 [SECURITY] CVE-2020-17527 Apache Tomcat HTTP/2 Request header mix-up",
                  refsource: "MLIST",
                  url: "https://lists.apache.org/thread.html/rce5ac9a40173651d540babce59f6f3825f12c6d4e886ba00823b11e5@%3Cannounce.tomcat.apache.org%3E",
               },
               {
                  name: "[oss-security] 20201203 [SECURITY] CVE-2020-17527 Apache Tomcat HTTP/2 Request header mix-up",
                  refsource: "MLIST",
                  url: "http://www.openwall.com/lists/oss-security/2020/12/03/3",
               },
               {
                  name: "[guacamole-issues] 20201206 [jira] [Created] (GUACAMOLE-1229) Fix in Dockerhub for latest CVE-2020-17527",
                  refsource: "MLIST",
                  url: "https://lists.apache.org/thread.html/rabbe6b3ae6a9795641d7a05c00d2378d5bbbe4240b7e20f09b092cce@%3Cissues.guacamole.apache.org%3E",
               },
               {
                  name: "[guacamole-issues] 20201206 [jira] [Commented] (GUACAMOLE-1229) Fix in Dockerhub for latest CVE-2020-17527",
                  refsource: "MLIST",
                  url: "https://lists.apache.org/thread.html/ra35c8d617b17d59f400112cebadec43ad379f98198b4a9726190d7ee@%3Cissues.guacamole.apache.org%3E",
               },
               {
                  name: "[tomee-commits] 20201207 [jira] [Created] (TOMEE-2936) TomEE plus(7.0.9) is affected by CVE-2020-17527(BDSA-2020-3628) vulnerability.",
                  refsource: "MLIST",
                  url: "https://lists.apache.org/thread.html/r9fd47f1b03e9b41d16a5cf72659b533887267d3398d963c2fff3abfa@%3Ccommits.tomee.apache.org%3E",
               },
               {
                  name: "[tomee-commits] 20201207 [jira] [Assigned] (TOMEE-2936) TomEE plus(7.0.9) is affected by CVE-2020-17527(BDSA-2020-3628) vulnerability.",
                  refsource: "MLIST",
                  url: "https://lists.apache.org/thread.html/r26a2a66339087fc37db3caf201e446d3e83b5cce314371e235ff1784@%3Ccommits.tomee.apache.org%3E",
               },
               {
                  name: "[debian-lts-announce] 20201216 [SECURITY] [DLA 2495-1] tomcat8 security update",
                  refsource: "MLIST",
                  url: "https://lists.debian.org/debian-lts-announce/2020/12/msg00022.html",
               },
               {
                  name: "GLSA-202012-23",
                  refsource: "GENTOO",
                  url: "https://security.gentoo.org/glsa/202012-23",
               },
               {
                  name: "[tomcat-dev] 20210114 svn commit: r1885488 - in /tomcat/site/trunk: docs/security-10.html docs/security-7.html docs/security-8.html docs/security-9.html xdocs/security-10.xml xdocs/security-7.xml xdocs/security-8.xml xdocs/security-9.xml",
                  refsource: "MLIST",
                  url: "https://lists.apache.org/thread.html/rca833c6d42b7b9ce1563488c0929f29fcc95947d86e5e740258c8937@%3Cdev.tomcat.apache.org%3E",
               },
               {
                  name: "[announce] 20210119 Re: [SECURITY][CORRECTION] CVE-2020-17527 Apache Tomcat HTTP/2 Request header mix-up",
                  refsource: "MLIST",
                  url: "https://lists.apache.org/thread.html/ra9fcdb904dd2e2256ef90b3e4ced279cd464cb0ab63a6c64df5c010d@%3Cannounce.apache.org%3E",
               },
               {
                  name: "[tomcat-dev] 20210119 Re: [SECURITY][CORRECTION] CVE-2020-17527 Apache Tomcat HTTP/2 Request header mix-up",
                  refsource: "MLIST",
                  url: "https://lists.apache.org/thread.html/r5a285242737ddef4d338236328aaaf3237183e1465a5efafd16b99ed@%3Cdev.tomcat.apache.org%3E",
               },
               {
                  name: "[tomcat-announce] 20210119 Re: [SECURITY][CORRECTION] CVE-2020-17527 Apache Tomcat HTTP/2 Request header mix-up",
                  refsource: "MLIST",
                  url: "https://lists.apache.org/thread.html/ra9fcdb904dd2e2256ef90b3e4ced279cd464cb0ab63a6c64df5c010d@%3Cannounce.tomcat.apache.org%3E",
               },
               {
                  name: "[tomcat-users] 20210119 Re: [SECURITY][CORRECTION] CVE-2020-17527 Apache Tomcat HTTP/2 Request header mix-up",
                  refsource: "MLIST",
                  url: "https://lists.apache.org/thread.html/rbba08c4dcef3603e36276d49adda8eedbe458c5104314b4038f697e1@%3Cusers.tomcat.apache.org%3E",
               },
               {
                  name: "DSA-4835",
                  refsource: "DEBIAN",
                  url: "https://www.debian.org/security/2021/dsa-4835",
               },
               {
                  name: "[tomee-commits] 20210319 [jira] [Updated] (TOMEE-2936) TomEE plus(7.0.9) is affected by CVE-2020-17527(BDSA-2020-3628) vulnerability.",
                  refsource: "MLIST",
                  url: "https://lists.apache.org/thread.html/r2d6e05c5ff96f8068a59dfdb3800e9ee8d4e36ce1971783c6e5f9b20@%3Ccommits.tomee.apache.org%3E",
               },
               {
                  name: "https://www.oracle.com/security-alerts/cpuApr2021.html",
                  refsource: "MISC",
                  url: "https://www.oracle.com/security-alerts/cpuApr2021.html",
               },
               {
                  name: "https://security.netapp.com/advisory/ntap-20201210-0003/",
                  refsource: "CONFIRM",
                  url: "https://security.netapp.com/advisory/ntap-20201210-0003/",
               },
               {
                  name: "https://www.oracle.com//security-alerts/cpujul2021.html",
                  refsource: "MISC",
                  url: "https://www.oracle.com//security-alerts/cpujul2021.html",
               },
               {
                  name: "https://www.oracle.com/security-alerts/cpujan2022.html",
                  refsource: "MISC",
                  url: "https://www.oracle.com/security-alerts/cpujan2022.html",
               },
               {
                  name: "https://www.oracle.com/security-alerts/cpuapr2022.html",
                  refsource: "MISC",
                  url: "https://www.oracle.com/security-alerts/cpuapr2022.html",
               },
            ],
         },
         source: {
            discovery: "UNKNOWN",
         },
      },
      "gitlab.com": {
         advisories: [
            {
               affected_range: "[8.5.1,8.5.59],[9.0.0,9.0.35],[9.0.35-3.39.1],[9.0.35-3.57.3], [9.0.36,9.0.39],[10.0.0]",
               affected_versions: "All versions starting from 8.5.1 up to 8.5.59, all versions starting from 9.0.0 up to 9.0.35, version 9.0.35-3.39.1, version 9.0.35-3.57.3, all versions starting from 9.0.36 up to 9.0.39, version 10.0.0",
               cvss_v2: "AV:N/AC:L/Au:N/C:P/I:N/A:N",
               cvss_v3: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
               cwe_ids: [
                  "CWE-1035",
                  "CWE-200",
                  "CWE-937",
               ],
               date: "2021-09-14",
               description: "While investigating bug it was discovered that Apache Tomcat to to to could re-use an HTTP request header value from the previous stream received on an `HTTP/2` connection for the request associated with the subsequent stream. While this would most likely lead to an error and the closure of the `HTTP/2` connection, it is possible that information could leak between requests.",
               fixed_versions: [
                  "8.5.60",
                  "9.0.40",
                  "10.0.2",
               ],
               identifier: "CVE-2020-17527",
               identifiers: [
                  "CVE-2020-17527",
               ],
               not_impacted: "All versions before 8.5.1, all versions after 8.5.59 before 9.0.0, all versions after 9.0.35 before 9.0.35-3.39.1, all versions after 9.0.35-3.39.1 before 9.0.35-3.57.3, all versions after 9.0.35-3.57.3 before 9.0.36, all versions after 9.0.39 before 10.0.0, all versions after 10.0.0",
               package_slug: "maven/org.apache.tomcat.embed/tomcat-embed-core",
               pubdate: "2020-12-03",
               solution: "Upgrade to versions 8.5.60, 9.0.40, 10.0.2 or above.",
               title: "Information Exposure",
               urls: [
                  "https://nvd.nist.gov/vuln/detail/CVE-2020-17527",
               ],
               uuid: "e9c7e687-4148-49e5-99bf-46d3cbb94970",
            },
            {
               affected_range: "[8.5.1,8.5.59],[9.0.0,9.0.35],[9.0.35-3.39.1],[9.0.35-3.57.3], [9.0.36,9.0.39],[10.0.0]",
               affected_versions: "All versions starting from 8.5.1 up to 8.5.59, all versions starting from 9.0.0 up to 9.0.35, version 9.0.35-3.39.1, version 9.0.35-3.57.3, all versions starting from 9.0.36 up to 9.0.39, version 10.0.0",
               cvss_v2: "AV:N/AC:L/Au:N/C:P/I:N/A:N",
               cvss_v3: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
               cwe_ids: [
                  "CWE-1035",
                  "CWE-200",
                  "CWE-937",
               ],
               date: "2021-09-14",
               description: "While investigating bug it was discovered that Apache Tomcat to to to could re-use an HTTP request header value from the previous stream received on an `HTTP/2` connection for the request associated with the subsequent stream. While this would most likely lead to an error and the closure of the `HTTP/2` connection, it is possible that information could leak between requests.",
               fixed_versions: [
                  "8.5.60",
                  "9.0.40",
                  "10.0.2",
               ],
               identifier: "CVE-2020-17527",
               identifiers: [
                  "CVE-2020-17527",
               ],
               not_impacted: "All versions before 8.5.1, all versions after 8.5.59 before 9.0.0, all versions after 9.0.35 before 9.0.35-3.39.1, all versions after 9.0.35-3.39.1 before 9.0.35-3.57.3, all versions after 9.0.35-3.57.3 before 9.0.36, all versions after 9.0.39 before 10.0.0, all versions after 10.0.0",
               package_slug: "maven/org.apache.tomcat/tomcat-catalina",
               pubdate: "2020-12-03",
               solution: "Upgrade to versions 8.5.60, 9.0.40, 10.0.2 or above.",
               title: "Information Exposure",
               urls: [
                  "https://nvd.nist.gov/vuln/detail/CVE-2020-17527",
               ],
               uuid: "71af14c2-aa33-4e2a-b1c3-9f9854f17224",
            },
            {
               affected_range: "[8.5.1,8.5.59],[9.0.0,9.0.35],[9.0.35-3.39.1],[9.0.35-3.57.3], [9.0.36,9.0.39],[10.0.0]",
               affected_versions: "All versions starting from 8.5.1 up to 8.5.59, all versions starting from 9.0.0 up to 9.0.35, version 9.0.35-3.39.1, version 9.0.35-3.57.3, all versions starting from 9.0.36 up to 9.0.39, version 10.0.0",
               cvss_v2: "AV:N/AC:L/Au:N/C:P/I:N/A:N",
               cvss_v3: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
               cwe_ids: [
                  "CWE-1035",
                  "CWE-200",
                  "CWE-937",
               ],
               date: "2021-09-14",
               description: "While investigating bug it was discovered that Apache Tomcat to to to could re-use an HTTP request header value from the previous stream received on an `HTTP/2` connection for the request associated with the subsequent stream. While this would most likely lead to an error and the closure of the `HTTP/2` connection, it is possible that information could leak between requests.",
               fixed_versions: [
                  "8.5.60",
                  "9.0.40",
                  "10.0.2",
               ],
               identifier: "CVE-2020-17527",
               identifiers: [
                  "CVE-2020-17527",
               ],
               not_impacted: "All versions before 8.5.1, all versions after 8.5.59 before 9.0.0, all versions after 9.0.35 before 9.0.35-3.39.1, all versions after 9.0.35-3.39.1 before 9.0.35-3.57.3, all versions after 9.0.35-3.57.3 before 9.0.36, all versions after 9.0.39 before 10.0.0, all versions after 10.0.0",
               package_slug: "maven/org.apache.tomcat/tomcat-coyote",
               pubdate: "2020-12-03",
               solution: "Upgrade to versions 8.5.60, 9.0.40, 10.0.2 or above.",
               title: "Information Exposure",
               urls: [
                  "https://nvd.nist.gov/vuln/detail/CVE-2020-17527",
               ],
               uuid: "2a89a60b-0e6b-4c77-85d4-fc19e5f3587b",
            },
            {
               affected_range: "[8.5.1,8.5.59],[9.0.0,9.0.35],[9.0.35-3.39.1], [9.0.35-3.57.3],[9.0.36,9.0.39],[10.0.0]",
               affected_versions: "All versions starting from 8.5.1 up to 8.5.59, all versions starting from 9.0.0 up to 9.0.35, version 9.0.35-3.39.1, version 9.0.35-3.57.3, all versions starting from 9.0.36 up to 9.0.39, version 10.0.0",
               cvss_v2: "AV:N/AC:L/Au:N/C:P/I:N/A:N",
               cvss_v3: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
               cwe_ids: [
                  "CWE-1035",
                  "CWE-200",
                  "CWE-937",
               ],
               date: "2021-09-14",
               description: "While investigating bug it was discovered that Apache Tomcat to to to could re-use an HTTP request header value from the previous stream received on an `HTTP/2` connection for the request associated with the subsequent stream. While this would most likely lead to an error and the closure of the `HTTP/2` connection, it is possible that information could leak between requests.",
               fixed_versions: [
                  "8.5.60",
                  "9.0.40",
                  "10.0.2",
               ],
               identifier: "CVE-2020-17527",
               identifiers: [
                  "CVE-2020-17527",
               ],
               not_impacted: "All versions before 8.5.1, all versions after 8.5.59 before 9.0.0, all versions after 9.0.35 before 9.0.35-3.39.1, all versions after 9.0.35-3.39.1 before 9.0.35-3.57.3, all versions after 9.0.35-3.57.3 before 9.0.36, all versions after 9.0.39 before 10.0.0, all versions after 10.0.0",
               package_slug: "maven/org.apache.tomcat/tomcat",
               pubdate: "2020-12-03",
               solution: "Upgrade to versions 8.5.60, 9.0.40, 10.0.2 or above.",
               title: "Information Exposure",
               urls: [
                  "https://nvd.nist.gov/vuln/detail/CVE-2020-17527",
               ],
               uuid: "dc6eb18a-ea3e-4a8c-b085-6bcdfe602780",
            },
         ],
      },
      "nvd.nist.gov": {
         configurations: {
            CVE_data_version: "4.0",
            nodes: [
               {
                  children: [],
                  cpe_match: [
                     {
                        cpe23Uri: "cpe:2.3:a:apache:tomcat:9.0.0:milestone10:*:*:*:*:*:*",
                        cpe_name: [],
                        vulnerable: true,
                     },
                     {
                        cpe23Uri: "cpe:2.3:a:apache:tomcat:9.0.0:milestone11:*:*:*:*:*:*",
                        cpe_name: [],
                        vulnerable: true,
                     },
                     {
                        cpe23Uri: "cpe:2.3:a:apache:tomcat:9.0.0:milestone12:*:*:*:*:*:*",
                        cpe_name: [],
                        vulnerable: true,
                     },
                     {
                        cpe23Uri: "cpe:2.3:a:apache:tomcat:9.0.0:milestone13:*:*:*:*:*:*",
                        cpe_name: [],
                        vulnerable: true,
                     },
                     {
                        cpe23Uri: "cpe:2.3:a:apache:tomcat:9.0.0:milestone14:*:*:*:*:*:*",
                        cpe_name: [],
                        vulnerable: true,
                     },
                     {
                        cpe23Uri: "cpe:2.3:a:apache:tomcat:9.0.0:milestone15:*:*:*:*:*:*",
                        cpe_name: [],
                        vulnerable: true,
                     },
                     {
                        cpe23Uri: "cpe:2.3:a:apache:tomcat:9.0.0:milestone16:*:*:*:*:*:*",
                        cpe_name: [],
                        vulnerable: true,
                     },
                     {
                        cpe23Uri: "cpe:2.3:a:apache:tomcat:9.0.0:milestone17:*:*:*:*:*:*",
                        cpe_name: [],
                        vulnerable: true,
                     },
                     {
                        cpe23Uri: "cpe:2.3:a:apache:tomcat:9.0.0:milestone18:*:*:*:*:*:*",
                        cpe_name: [],
                        vulnerable: true,
                     },
                     {
                        cpe23Uri: "cpe:2.3:a:apache:tomcat:9.0.0:milestone19:*:*:*:*:*:*",
                        cpe_name: [],
                        vulnerable: true,
                     },
                     {
                        cpe23Uri: "cpe:2.3:a:apache:tomcat:9.0.0:milestone20:*:*:*:*:*:*",
                        cpe_name: [],
                        vulnerable: true,
                     },
                     {
                        cpe23Uri: "cpe:2.3:a:apache:tomcat:9.0.0:milestone21:*:*:*:*:*:*",
                        cpe_name: [],
                        vulnerable: true,
                     },
                     {
                        cpe23Uri: "cpe:2.3:a:apache:tomcat:9.0.0:milestone22:*:*:*:*:*:*",
                        cpe_name: [],
                        vulnerable: true,
                     },
                     {
                        cpe23Uri: "cpe:2.3:a:apache:tomcat:9.0.0:milestone23:*:*:*:*:*:*",
                        cpe_name: [],
                        vulnerable: true,
                     },
                     {
                        cpe23Uri: "cpe:2.3:a:apache:tomcat:9.0.0:milestone24:*:*:*:*:*:*",
                        cpe_name: [],
                        vulnerable: true,
                     },
                     {
                        cpe23Uri: "cpe:2.3:a:apache:tomcat:9.0.0:milestone25:*:*:*:*:*:*",
                        cpe_name: [],
                        vulnerable: true,
                     },
                     {
                        cpe23Uri: "cpe:2.3:a:apache:tomcat:9.0.0:milestone26:*:*:*:*:*:*",
                        cpe_name: [],
                        vulnerable: true,
                     },
                     {
                        cpe23Uri: "cpe:2.3:a:apache:tomcat:9.0.0:milestone27:*:*:*:*:*:*",
                        cpe_name: [],
                        vulnerable: true,
                     },
                     {
                        cpe23Uri: "cpe:2.3:a:apache:tomcat:9.0.0:milestone5:*:*:*:*:*:*",
                        cpe_name: [],
                        vulnerable: true,
                     },
                     {
                        cpe23Uri: "cpe:2.3:a:apache:tomcat:9.0.0:milestone6:*:*:*:*:*:*",
                        cpe_name: [],
                        vulnerable: true,
                     },
                     {
                        cpe23Uri: "cpe:2.3:a:apache:tomcat:9.0.0:milestone7:*:*:*:*:*:*",
                        cpe_name: [],
                        vulnerable: true,
                     },
                     {
                        cpe23Uri: "cpe:2.3:a:apache:tomcat:9.0.0:milestone8:*:*:*:*:*:*",
                        cpe_name: [],
                        vulnerable: true,
                     },
                     {
                        cpe23Uri: "cpe:2.3:a:apache:tomcat:9.0.0:milestone9:*:*:*:*:*:*",
                        cpe_name: [],
                        vulnerable: true,
                     },
                     {
                        cpe23Uri: "cpe:2.3:a:apache:tomcat:9.0.36:*:*:*:*:*:*:*",
                        cpe_name: [],
                        vulnerable: true,
                     },
                     {
                        cpe23Uri: "cpe:2.3:a:apache:tomcat:10.0.0:milestone1:*:*:*:*:*:*",
                        cpe_name: [],
                        vulnerable: true,
                     },
                     {
                        cpe23Uri: "cpe:2.3:a:apache:tomcat:10.0.0:milestone2:*:*:*:*:*:*",
                        cpe_name: [],
                        vulnerable: true,
                     },
                     {
                        cpe23Uri: "cpe:2.3:a:apache:tomcat:10.0.0:milestone3:*:*:*:*:*:*",
                        cpe_name: [],
                        vulnerable: true,
                     },
                     {
                        cpe23Uri: "cpe:2.3:a:apache:tomcat:10.0.0:milestone4:*:*:*:*:*:*",
                        cpe_name: [],
                        vulnerable: true,
                     },
                     {
                        cpe23Uri: "cpe:2.3:a:apache:tomcat:10.0.0:milestone5:*:*:*:*:*:*",
                        cpe_name: [],
                        vulnerable: true,
                     },
                     {
                        cpe23Uri: "cpe:2.3:a:apache:tomcat:10.0.0:milestone6:*:*:*:*:*:*",
                        cpe_name: [],
                        vulnerable: true,
                     },
                     {
                        cpe23Uri: "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*",
                        cpe_name: [],
                        versionEndIncluding: "8.5.59",
                        versionStartIncluding: "8.5.1",
                        vulnerable: true,
                     },
                     {
                        cpe23Uri: "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*",
                        cpe_name: [],
                        versionEndIncluding: "9.0.35",
                        versionStartIncluding: "9.0.1",
                        vulnerable: true,
                     },
                     {
                        cpe23Uri: "cpe:2.3:a:apache:tomcat:9.0.35-3.39.1:*:*:*:*:*:*:*",
                        cpe_name: [],
                        vulnerable: true,
                     },
                     {
                        cpe23Uri: "cpe:2.3:a:apache:tomcat:9.0.35-3.57.3:*:*:*:*:*:*:*",
                        cpe_name: [],
                        vulnerable: true,
                     },
                     {
                        cpe23Uri: "cpe:2.3:a:apache:tomcat:9.0.37:*:*:*:*:*:*:*",
                        cpe_name: [],
                        vulnerable: true,
                     },
                     {
                        cpe23Uri: "cpe:2.3:a:apache:tomcat:9.0.38:*:*:*:*:*:*:*",
                        cpe_name: [],
                        vulnerable: true,
                     },
                     {
                        cpe23Uri: "cpe:2.3:a:apache:tomcat:9.0.39:*:*:*:*:*:*:*",
                        cpe_name: [],
                        vulnerable: true,
                     },
                     {
                        cpe23Uri: "cpe:2.3:a:apache:tomcat:10.0.0:milestone7:*:*:*:*:*:*",
                        cpe_name: [],
                        vulnerable: true,
                     },
                     {
                        cpe23Uri: "cpe:2.3:a:apache:tomcat:10.0.0:milestone8:*:*:*:*:*:*",
                        cpe_name: [],
                        vulnerable: true,
                     },
                     {
                        cpe23Uri: "cpe:2.3:a:apache:tomcat:10.0.0:milestone9:*:*:*:*:*:*",
                        cpe_name: [],
                        vulnerable: true,
                     },
                  ],
                  operator: "OR",
               },
               {
                  children: [],
                  cpe_match: [
                     {
                        cpe23Uri: "cpe:2.3:a:netapp:oncommand_system_manager:*:*:*:*:*:*:*:*",
                        cpe_name: [],
                        versionEndIncluding: "3.1.3",
                        versionStartIncluding: "3.0.0",
                        vulnerable: true,
                     },
                     {
                        cpe23Uri: "cpe:2.3:a:netapp:element_plug-in:-:*:*:*:*:vcenter_server:*:*",
                        cpe_name: [],
                        vulnerable: true,
                     },
                  ],
                  operator: "OR",
               },
               {
                  children: [],
                  cpe_match: [
                     {
                        cpe23Uri: "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*",
                        cpe_name: [],
                        vulnerable: true,
                     },
                     {
                        cpe23Uri: "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
                        cpe_name: [],
                        vulnerable: true,
                     },
                  ],
                  operator: "OR",
               },
               {
                  children: [],
                  cpe_match: [
                     {
                        cpe23Uri: "cpe:2.3:a:oracle:instantis_enterprisetrack:17.1:*:*:*:*:*:*:*",
                        cpe_name: [],
                        vulnerable: true,
                     },
                     {
                        cpe23Uri: "cpe:2.3:a:oracle:instantis_enterprisetrack:17.2:*:*:*:*:*:*:*",
                        cpe_name: [],
                        vulnerable: true,
                     },
                     {
                        cpe23Uri: "cpe:2.3:a:oracle:instantis_enterprisetrack:17.3:*:*:*:*:*:*:*",
                        cpe_name: [],
                        vulnerable: true,
                     },
                     {
                        cpe23Uri: "cpe:2.3:a:oracle:sd-wan_edge:9.0:*:*:*:*:*:*:*",
                        cpe_name: [],
                        vulnerable: true,
                     },
                     {
                        cpe23Uri: "cpe:2.3:a:oracle:workload_manager:18c:*:*:*:*:*:*:*",
                        cpe_name: [],
                        vulnerable: true,
                     },
                     {
                        cpe23Uri: "cpe:2.3:a:oracle:workload_manager:19c:*:*:*:*:*:*:*",
                        cpe_name: [],
                        vulnerable: true,
                     },
                     {
                        cpe23Uri: "cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:*",
                        cpe_name: [],
                        versionEndExcluding: "8.0.23",
                        vulnerable: true,
                     },
                     {
                        cpe23Uri: "cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:1.10.0:*:*:*:*:*:*:*",
                        cpe_name: [],
                        vulnerable: true,
                     },
                     {
                        cpe23Uri: "cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.14.0:*:*:*:*:*:*:*",
                        cpe_name: [],
                        vulnerable: true,
                     },
                     {
                        cpe23Uri: "cpe:2.3:a:oracle:communications_instant_messaging_server:10.0.1.5.0:*:*:*:*:*:*:*",
                        cpe_name: [],
                        vulnerable: true,
                     },
                     {
                        cpe23Uri: "cpe:2.3:a:oracle:blockchain_platform:*:*:*:*:*:*:*:*",
                        cpe_name: [],
                        versionEndExcluding: "21.1.2",
                        vulnerable: true,
                     },
                  ],
                  operator: "OR",
               },
            ],
         },
         cve: {
            CVE_data_meta: {
               ASSIGNER: "security@apache.org",
               ID: "CVE-2020-17527",
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "en",
                     value: "While investigating bug 64830 it was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request header value from the previous stream received on an HTTP/2 connection for the request associated with the subsequent stream. While this would most likely lead to an error and the closure of the HTTP/2 connection, it is possible that information could leak between requests.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "en",
                           value: "CWE-200",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://lists.apache.org/thread.html/rce5ac9a40173651d540babce59f6f3825f12c6d4e886ba00823b11e5%40%3Cannounce.tomcat.apache.org%3E",
                     refsource: "MISC",
                     tags: [
                        "Mailing List",
                        "Vendor Advisory",
                     ],
                     url: "https://lists.apache.org/thread.html/rce5ac9a40173651d540babce59f6f3825f12c6d4e886ba00823b11e5%40%3Cannounce.tomcat.apache.org%3E",
                  },
                  {
                     name: "[tomcat-announce] 20201203 [SECURITY] CVE-2020-17527 Apache Tomcat HTTP/2 Request header mix-up",
                     refsource: "MLIST",
                     tags: [
                        "Mailing List",
                        "Vendor Advisory",
                     ],
                     url: "https://lists.apache.org/thread.html/rce5ac9a40173651d540babce59f6f3825f12c6d4e886ba00823b11e5@%3Cannounce.tomcat.apache.org%3E",
                  },
                  {
                     name: "[announce] 20201203 [SECURITY] CVE-2020-17527 Apache Tomcat HTTP/2 Request header mix-up",
                     refsource: "MLIST",
                     tags: [
                        "Mailing List",
                        "Vendor Advisory",
                     ],
                     url: "https://lists.apache.org/thread.html/rce5ac9a40173651d540babce59f6f3825f12c6d4e886ba00823b11e5@%3Cannounce.apache.org%3E",
                  },
                  {
                     name: "[tomcat-dev] 20201203 svn commit: r1884073 - in /tomcat/site/trunk: docs/security-10.html docs/security-8.html docs/security-9.html xdocs/security-10.xml xdocs/security-8.xml xdocs/security-9.xml",
                     refsource: "MLIST",
                     tags: [
                        "Mailing List",
                        "Vendor Advisory",
                     ],
                     url: "https://lists.apache.org/thread.html/raa0e9ad388c1e6fd1e301b5e080f9439f64cb4178119a86a4801cc53@%3Cdev.tomcat.apache.org%3E",
                  },
                  {
                     name: "[tomcat-users] 20201203 [SECURITY] CVE-2020-17527 Apache Tomcat HTTP/2 Request header mix-up",
                     refsource: "MLIST",
                     tags: [
                        "Mailing List",
                        "Vendor Advisory",
                     ],
                     url: "https://lists.apache.org/thread.html/rd5babd13d7a350b369b2f647b4dd32ce678af42f9aba5389df1ae6ca@%3Cusers.tomcat.apache.org%3E",
                  },
                  {
                     name: "[tomcat-dev] 20201203 [SECURITY] CVE-2020-17527 Apache Tomcat HTTP/2 Request header mix-up",
                     refsource: "MLIST",
                     tags: [
                        "Mailing List",
                        "Vendor Advisory",
                     ],
                     url: "https://lists.apache.org/thread.html/r8a227ac6a755a6406c1cc47dd48800e973d4cf13fe7fe68ac59c679c@%3Cdev.tomcat.apache.org%3E",
                  },
                  {
                     name: "[oss-security] 20201203 [SECURITY] CVE-2020-17527 Apache Tomcat HTTP/2 Request header mix-up",
                     refsource: "MLIST",
                     tags: [
                        "Mailing List",
                        "Third Party Advisory",
                     ],
                     url: "http://www.openwall.com/lists/oss-security/2020/12/03/3",
                  },
                  {
                     name: "[guacamole-issues] 20201206 [jira] [Created] (GUACAMOLE-1229) Fix in Dockerhub for latest CVE-2020-17527",
                     refsource: "MLIST",
                     tags: [
                        "Mailing List",
                        "Vendor Advisory",
                     ],
                     url: "https://lists.apache.org/thread.html/rabbe6b3ae6a9795641d7a05c00d2378d5bbbe4240b7e20f09b092cce@%3Cissues.guacamole.apache.org%3E",
                  },
                  {
                     name: "[guacamole-issues] 20201206 [jira] [Commented] (GUACAMOLE-1229) Fix in Dockerhub for latest CVE-2020-17527",
                     refsource: "MLIST",
                     tags: [
                        "Mailing List",
                        "Vendor Advisory",
                     ],
                     url: "https://lists.apache.org/thread.html/ra35c8d617b17d59f400112cebadec43ad379f98198b4a9726190d7ee@%3Cissues.guacamole.apache.org%3E",
                  },
                  {
                     name: "[tomee-commits] 20201207 [jira] [Created] (TOMEE-2936) TomEE plus(7.0.9) is affected by CVE-2020-17527(BDSA-2020-3628) vulnerability.",
                     refsource: "MLIST",
                     tags: [
                        "Mailing List",
                        "Vendor Advisory",
                     ],
                     url: "https://lists.apache.org/thread.html/r9fd47f1b03e9b41d16a5cf72659b533887267d3398d963c2fff3abfa@%3Ccommits.tomee.apache.org%3E",
                  },
                  {
                     name: "[tomee-commits] 20201207 [jira] [Assigned] (TOMEE-2936) TomEE plus(7.0.9) is affected by CVE-2020-17527(BDSA-2020-3628) vulnerability.",
                     refsource: "MLIST",
                     tags: [
                        "Mailing List",
                        "Vendor Advisory",
                     ],
                     url: "https://lists.apache.org/thread.html/r26a2a66339087fc37db3caf201e446d3e83b5cce314371e235ff1784@%3Ccommits.tomee.apache.org%3E",
                  },
                  {
                     name: "https://security.netapp.com/advisory/ntap-20201210-0003/",
                     refsource: "CONFIRM",
                     tags: [
                        "Third Party Advisory",
                     ],
                     url: "https://security.netapp.com/advisory/ntap-20201210-0003/",
                  },
                  {
                     name: "[debian-lts-announce] 20201216 [SECURITY] [DLA 2495-1] tomcat8 security update",
                     refsource: "MLIST",
                     tags: [
                        "Mailing List",
                        "Third Party Advisory",
                     ],
                     url: "https://lists.debian.org/debian-lts-announce/2020/12/msg00022.html",
                  },
                  {
                     name: "GLSA-202012-23",
                     refsource: "GENTOO",
                     tags: [
                        "Third Party Advisory",
                     ],
                     url: "https://security.gentoo.org/glsa/202012-23",
                  },
                  {
                     name: "[tomcat-dev] 20210114 svn commit: r1885488 - in /tomcat/site/trunk: docs/security-10.html docs/security-7.html docs/security-8.html docs/security-9.html xdocs/security-10.xml xdocs/security-7.xml xdocs/security-8.xml xdocs/security-9.xml",
                     refsource: "MLIST",
                     tags: [
                        "Mailing List",
                        "Vendor Advisory",
                     ],
                     url: "https://lists.apache.org/thread.html/rca833c6d42b7b9ce1563488c0929f29fcc95947d86e5e740258c8937@%3Cdev.tomcat.apache.org%3E",
                  },
                  {
                     name: "[announce] 20210119 Re: [SECURITY][CORRECTION] CVE-2020-17527 Apache Tomcat HTTP/2 Request header mix-up",
                     refsource: "MLIST",
                     tags: [
                        "Mailing List",
                        "Vendor Advisory",
                     ],
                     url: "https://lists.apache.org/thread.html/ra9fcdb904dd2e2256ef90b3e4ced279cd464cb0ab63a6c64df5c010d@%3Cannounce.apache.org%3E",
                  },
                  {
                     name: "[tomcat-users] 20210119 Re: [SECURITY][CORRECTION] CVE-2020-17527 Apache Tomcat HTTP/2 Request header mix-up",
                     refsource: "MLIST",
                     tags: [
                        "Mailing List",
                        "Vendor Advisory",
                     ],
                     url: "https://lists.apache.org/thread.html/rbba08c4dcef3603e36276d49adda8eedbe458c5104314b4038f697e1@%3Cusers.tomcat.apache.org%3E",
                  },
                  {
                     name: "[tomcat-announce] 20210119 Re: [SECURITY][CORRECTION] CVE-2020-17527 Apache Tomcat HTTP/2 Request header mix-up",
                     refsource: "MLIST",
                     tags: [
                        "Mailing List",
                        "Vendor Advisory",
                     ],
                     url: "https://lists.apache.org/thread.html/ra9fcdb904dd2e2256ef90b3e4ced279cd464cb0ab63a6c64df5c010d@%3Cannounce.tomcat.apache.org%3E",
                  },
                  {
                     name: "[tomcat-dev] 20210119 Re: [SECURITY][CORRECTION] CVE-2020-17527 Apache Tomcat HTTP/2 Request header mix-up",
                     refsource: "MLIST",
                     tags: [
                        "Mailing List",
                        "Vendor Advisory",
                     ],
                     url: "https://lists.apache.org/thread.html/r5a285242737ddef4d338236328aaaf3237183e1465a5efafd16b99ed@%3Cdev.tomcat.apache.org%3E",
                  },
                  {
                     name: "DSA-4835",
                     refsource: "DEBIAN",
                     tags: [
                        "Third Party Advisory",
                     ],
                     url: "https://www.debian.org/security/2021/dsa-4835",
                  },
                  {
                     name: "[tomee-commits] 20210319 [jira] [Updated] (TOMEE-2936) TomEE plus(7.0.9) is affected by CVE-2020-17527(BDSA-2020-3628) vulnerability.",
                     refsource: "MLIST",
                     tags: [
                        "Mailing List",
                        "Vendor Advisory",
                     ],
                     url: "https://lists.apache.org/thread.html/r2d6e05c5ff96f8068a59dfdb3800e9ee8d4e36ce1971783c6e5f9b20@%3Ccommits.tomee.apache.org%3E",
                  },
                  {
                     name: "https://www.oracle.com/security-alerts/cpuApr2021.html",
                     refsource: "MISC",
                     tags: [
                        "Patch",
                        "Third Party Advisory",
                     ],
                     url: "https://www.oracle.com/security-alerts/cpuApr2021.html",
                  },
                  {
                     name: "N/A",
                     refsource: "N/A",
                     tags: [
                        "Patch",
                        "Third Party Advisory",
                     ],
                     url: "https://www.oracle.com//security-alerts/cpujul2021.html",
                  },
                  {
                     name: "https://www.oracle.com/security-alerts/cpujan2022.html",
                     refsource: "MISC",
                     tags: [
                        "Patch",
                        "Third Party Advisory",
                     ],
                     url: "https://www.oracle.com/security-alerts/cpujan2022.html",
                  },
                  {
                     name: "https://www.oracle.com/security-alerts/cpuapr2022.html",
                     refsource: "MISC",
                     tags: [
                        "Patch",
                        "Third Party Advisory",
                     ],
                     url: "https://www.oracle.com/security-alerts/cpuapr2022.html",
                  },
               ],
            },
         },
         impact: {
            baseMetricV2: {
               acInsufInfo: false,
               cvssV2: {
                  accessComplexity: "LOW",
                  accessVector: "NETWORK",
                  authentication: "NONE",
                  availabilityImpact: "NONE",
                  baseScore: 5,
                  confidentialityImpact: "PARTIAL",
                  integrityImpact: "NONE",
                  vectorString: "AV:N/AC:L/Au:N/C:P/I:N/A:N",
                  version: "2.0",
               },
               exploitabilityScore: 10,
               impactScore: 2.9,
               obtainAllPrivilege: false,
               obtainOtherPrivilege: false,
               obtainUserPrivilege: false,
               severity: "MEDIUM",
               userInteractionRequired: false,
            },
            baseMetricV3: {
               cvssV3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
                  version: "3.1",
               },
               exploitabilityScore: 3.9,
               impactScore: 3.6,
            },
         },
         lastModifiedDate: "2022-05-12T14:47Z",
         publishedDate: "2020-12-03T19:15Z",
      },
   },
}