CVE-2020-13943 Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat
An attacker can cause users to see responses for unexpected resources by violating HTTP/2 stream limits, leading to information disclosure.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-13943?
CVE-2020-13943 is a medium-severity vulnerability in Apache Tomcat, published on 12 Oct 2020. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This could lead to users seeing responses for unexpected resources.
Which versions are affected by CVE-2020-13943?
7 open source packages ship an affected version, including org.apache.tomcat:tomcat-coyote and tomcat. It affects 4 products.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.tomcat:tomcat-coyote Maven | From 10.0.0-M1 | 10.0.0-M8 |
org.apache.tomcat:tomcat-coyote Maven | From 10.0.0-M1 | 10.0.0-M8 |
org.apache.tomcat:tomcat-coyote Maven | From 8.5.0 | 8.5.58 |
org.apache.tomcat:tomcat-coyote Maven | From 8.5.0 | 8.5.58 |
org.apache.tomcat:tomcat-coyote Maven | From 9.0.0-M1 | 9.0.38 |
org.apache.tomcat:tomcat-coyote Maven | From 9.0.0-M1 | 9.0.38 |
1 more packages
tomcat Bitnami | From 8.5.0 | 8.5.1, 8.5.2, 8.5.3, 8.5.4, 8.5.5, 8.5.6, 8.5.7, 8.5.8, 8.5.9, 8.5.10, 8.5.11, 8.5.12, 8.5.13, 8.5.14, 8.5.15, 8.5.16, 8.5.17, 8.5.18, 8.5.19, 8.5.20, 8.5.21, 8.5.22, 8.5.23, 8.5.24, 8.5.25, 8.5.26, 8.5.27, 8.5.28, 8.5.29, 8.5.30, 8.5.31, 8.5.32, 8.5.33, 8.5.34, 8.5.35, 8.5.36, 8.5.37, 8.5.38, 8.5.39, 8.5.40, 8.5.41, 8.5.42, 8.5.43, 8.5.44, 8.5.45, 8.5.46, 8.5.47, 8.5.48, 8.5.49, 8.5.50, 8.5.51, 8.5.52, 8.5.53, 8.5.54, 8.5.55, 8.5.56, 8.5.57, 8.5.58, 9.0.38 |
Linux distribution packages (6)
tomcat SUSE:Linux Enterprise Module for Web and Scripting 15 SP1 | All versions | 9.0.36-4.47.3 |
tomcat SUSE:Linux Enterprise Module for Web and Scripting 15 SP2 | All versions | 9.0.36-3.12.3 |
tomcat SUSE:Linux Enterprise Server 12 SP5 | All versions | 9.0.36-3.50.1 |
tomcat SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | All versions | 9.0.36-3.50.1 |
tomcat openSUSE:Leap 15.1 | All versions | 9.0.36-lp151.3.33.1 |
tomcat openSUSE:Leap 15.2 | All versions | 9.0.36-lp152.2.10.1 |
Products include Apache Tomcat, Debian Debian Linux, Oracle Instantis Enterprisetrack, Oracle Sd-Wan Edge.
How do I fix CVE-2020-13943?
Upgrade org.apache.tomcat:tomcat-coyote to a fixed version for your release line: 10.0.0-M8, 8.5.58 or 9.0.38.
Is CVE-2020-13943 being exploited?
There is no known exploitation of CVE-2020-13943 in the wild and no public exploit code.
Other vulnerabilities in Apache Tomcat
Sources
Also known as BIT-tomcat-2020-13943, DEBIAN-CVE-2020-13943, DLA-2407-1, GHSA-f268-65qc-98vg, MGASA-2020-0397, SUSE-SU-2020:2996-1 and 4 more.