tomcat9 - security update

Fixed packages 1

Vulnerabilities 4

• High 7.5
  CVE-2020-11996 Public exploit EPSS 27%

  Uncontrolled Resource Consumption in Apache Tomcat

  A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU usage for several seconds. If a sufficient number of such requests were made on concurrent HTTP/2 conne…

  Apache Apache Tomcat org.apache.tomcat:tomcat tomcat8 Debian Ubuntu Maven
  Jun 26, 2020
• High 7.5
  CVE-2020-13934 EPSS 64%

  Improper Restriction of Operations within the Bounds of a Memory Buffer in Apache Tomcat

  An h2c direct connection to Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36 and 8.5.1 to 8.5.56 did not release the HTTP/1.1 processor after the upgrade to HTTP/2. If a sufficient number of such requests were made, an OutOfMemoryException could occur…

  org.apache.tomcat:tomcat tomcat9 tomcat8 tomcat9 Debian Ubuntu Maven
  Jul 14, 2020
• High 7.5
  CVE-2020-13935 Public exploit EPSS 87%

  Infinite Loop in Apache Tomcat

  The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid payload lengths could trigger an infinite loop. Multiple requests with invalid payl…

  org.apache.tomcat:tomcat tomcat9 tomcat8 tomcat9 Debian Ubuntu Maven
  Jul 14, 2020
• High 7.0
  CVE-2020-9484 Public exploit Scanner template EPSS 56%

  Potential remote code execution in Apache Tomcat

  When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use the PersistenceManage…

  tomcat9 tomcat8 tomcat9 tomcat7 Debian Ubuntu Maven
  May 20, 2020