CVE-2020-17527 Apache Tomcat: Request header mix-up between HTTP/2 streams
Apache Tomcat may leak request header information between HTTP/2 streams, potentially exposing sensitive data to attackers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-17527?
CVE-2020-17527 is a high-severity vulnerability in Apache Tomcat, published on 3 Dec 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
While investigating bug 64830 it was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request header value from the previous stream received on an HTTP/2 connection for the request associated with the subsequent stream. While this would most likely lead to an error and the closure of the HTTP/2 connection, it is possible that information could leak between requests.
Weakness: CWE-200
Which versions are affected by CVE-2020-17527?
7 open source packages ship an affected version, including org.apache.tomcat:tomcat-coyote and tomcat. It affects 12 products.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.tomcat:tomcat-coyote Maven | From 10.0.0-M1 | 10.0.0-M10 |
org.apache.tomcat:tomcat-coyote Maven | From 10.0.0-M1 | 10.0.0-M10 |
org.apache.tomcat:tomcat-coyote Maven | From 8.5.0 | 8.5.60 |
org.apache.tomcat:tomcat-coyote Maven | From 8.5.0 | 8.5.60 |
org.apache.tomcat:tomcat-coyote Maven | From 9.0.0-M1 | 9.0.40 |
org.apache.tomcat:tomcat-coyote Maven | From 9.0.0-M1 | 9.0.40 |
1 more packages
tomcat Bitnami | From 8.5.1 | 8.5.60, 9.0.40 |
Linux distribution packages (10)
tomcat SUSE:Linux Enterprise Module for Web and Scripting 15 SP1 | All versions | 9.0.36-4.53.1 |
tomcat SUSE:Linux Enterprise Module for Web and Scripting 15 SP2 | All versions | 9.0.36-3.18.1 |
tomcat SUSE:Linux Enterprise Server 12 SP4-LTSS | All versions | 9.0.36-3.58.1 |
tomcat SUSE:Linux Enterprise Server 12 SP5 | All versions | 9.0.36-3.58.1 |
tomcat SUSE:Linux Enterprise Server for SAP Applications 12 SP4 | All versions | 9.0.36-3.58.1 |
tomcat SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | All versions | 9.0.36-3.58.1 |
tomcat SUSE:OpenStack Cloud 9 | All versions | 9.0.36-3.58.1 |
tomcat SUSE:OpenStack Cloud Crowbar 9 | All versions | 9.0.36-3.58.1 |
tomcat openSUSE:Leap 15.1 | All versions | 9.0.36-lp151.3.39.1 |
tomcat openSUSE:Leap 15.2 | All versions | 9.0.36-lp152.2.16.1 |
Products include Apache Tomcat, Debian Debian Linux, Netapp Element Plug-In, Netapp Oncommand System Manager, Oracle Blockchain Platform, Oracle Communications Cloud Native Core Binding Support Function and 6 more.
How do I fix CVE-2020-17527?
Upgrade org.apache.tomcat:tomcat-coyote to a fixed version for your release line: 10.0.0-M10, 8.5.60 or 9.0.40.
Is CVE-2020-17527 being exploited?
There is no known exploitation of CVE-2020-17527 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Apache Tomcat
Sources
Also known as AZL-6909, AZL-7384, BIT-tomcat-2020-17527, DEBIAN-CVE-2020-17527, DLA-2495-1, GHSA-vvw4-rfwf-p6hx and 7 more.