CVE-2020-17527

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2020-17527
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-17527.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2020-17527
Aliases
Downstream
Related
Published
2020-12-03T19:15:12.200Z
Modified
2026-07-08T05:56:34.233773624Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
[none]
Details

While investigating bug 64830 it was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request header value from the previous stream received on an HTTP/2 connection for the request associated with the subsequent stream. While this would most likely lead to an error and the closure of the HTTP/2 connection, it is possible that information could leak between requests.

Database specific 
{
    "unresolved_ranges": [
        {
            "cpes": [
                "cpe:2.3:a:netapp:oncommand_system_manager:*:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "introduced": "3.0.0"
                },
                {
                    "last_affected": "3.1.3"
                }
            ],
            "source": "CPE_RANGE",
            "vendor_product": "netapp:oncommand_system_manager"
        },
        {
            "cpes": [
                "cpe:2.3:a:oracle:blockchain_platform:*:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "fixed": "21.1.2"
                }
            ],
            "source": "CPE_RANGE",
            "vendor_product": "oracle:blockchain_platform"
        },
        {
            "cpes": [
                "cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "fixed": "8.0.23"
                }
            ],
            "source": "CPE_RANGE",
            "vendor_product": "oracle:mysql_enterprise_monitor"
        },
        {
            "cpes": [
                "cpe:2.3:a:apache:tomcat:9.0.35-3.39.1:*:*:*:*:*:*:*",
                "cpe:2.3:a:apache:tomcat:9.0.35-3.57.3:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "introduced": "9.0.35-3.39.1"
                },
                {
                    "last_affected": "9.0.35-3.39.1"
                },
                {
                    "introduced": "9.0.35-3.57.3"
                },
                {
                    "last_affected": "9.0.35-3.57.3"
                }
            ],
            "source": "CPE_STRING",
            "vendor_product": "apache:tomcat"
        },
        {
            "cpes": [
                "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
                "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "introduced": "9.0"
                },
                {
                    "last_affected": "9.0"
                },
                {
                    "introduced": "10.0"
                },
                {
                    "last_affected": "10.0"
                }
            ],
            "source": "CPE_STRING",
            "vendor_product": "debian:debian_linux"
        },
        {
            "cpes": [
                "cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:1.10.0:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "introduced": "1.10.0"
                },
                {
                    "last_affected": "1.10.0"
                }
            ],
            "source": "CPE_STRING",
            "vendor_product": "oracle:communications_cloud_native_core_binding_support_function"
        },
        {
            "cpes": [
                "cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.14.0:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "introduced": "1.14.0"
                },
                {
                    "last_affected": "1.14.0"
                }
            ],
            "source": "CPE_STRING",
            "vendor_product": "oracle:communications_cloud_native_core_policy"
        },
        {
            "cpes": [
                "cpe:2.3:a:oracle:communications_instant_messaging_server:10.0.1.5.0:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "introduced": "10.0.1.5.0"
                },
                {
                    "last_affected": "10.0.1.5.0"
                }
            ],
            "source": "CPE_STRING",
            "vendor_product": "oracle:communications_instant_messaging_server"
        },
        {
            "cpes": [
                "cpe:2.3:a:oracle:instantis_enterprisetrack:17.1:*:*:*:*:*:*:*",
                "cpe:2.3:a:oracle:instantis_enterprisetrack:17.2:*:*:*:*:*:*:*",
                "cpe:2.3:a:oracle:instantis_enterprisetrack:17.3:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "introduced": "17.1"
                },
                {
                    "last_affected": "17.1"
                },
                {
                    "introduced": "17.2"
                },
                {
                    "last_affected": "17.2"
                },
                {
                    "introduced": "17.3"
                },
                {
                    "last_affected": "17.3"
                }
            ],
            "source": "CPE_STRING",
            "vendor_product": "oracle:instantis_enterprisetrack"
        },
        {
            "cpes": [
                "cpe:2.3:a:oracle:sd-wan_edge:9.0:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "introduced": "9.0"
                },
                {
                    "last_affected": "9.0"
                }
            ],
            "source": "CPE_STRING",
            "vendor_product": "oracle:sd-wan_edge"
        },
        {
            "cpes": [
                "cpe:2.3:a:oracle:workload_manager:18c:*:*:*:*:*:*:*",
                "cpe:2.3:a:oracle:workload_manager:19c:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "introduced": "18c"
                },
                {
                    "last_affected": "18c"
                },
                {
                    "introduced": "19c"
                },
                {
                    "last_affected": "19c"
                }
            ],
            "source": "CPE_STRING",
            "vendor_product": "oracle:workload_manager"
        }
    ]
}
References

Affected packages

Git / github.com/apache/tomcat

Affected ranges

Type
GIT
Repo
https://github.com/apache/tomcat
Events
Introduced
389365303d986b2a918bc95f39421b27a2c9ff30
Last affected
c042ec71219dbde3e1ce0381ce5be0801120d0fa
Introduced
3c78e95e36268dfb76db1570f0cf49104fa6eabc
Last affected
fc2c65d390444d75412855ad0de8b878018d02dc
Introduced
10e04de1946981261a734507f4a6d953e2a206fe
Last affected
6f143d19d151620cd0bfe9ec2ffa429e36ad0e45
Database specific 
{
    "extracted_events": [
        {
            "introduced": "8.5.1"
        },
        {
            "last_affected": "8.5.59"
        },
        {
            "introduced": "9.0.1"
        },
        {
            "last_affected": "9.0.35"
        },
        {
            "introduced": "9.0.0-milestone10"
        },
        {
            "last_affected": "9.0.0-milestone10"
        },
        {
            "introduced": "9.0.0-milestone11"
        },
        {
            "last_affected": "9.0.0-milestone11"
        },
        {
            "introduced": "9.0.0-milestone12"
        },
        {
            "last_affected": "9.0.0-milestone12"
        },
        {
            "introduced": "9.0.0-milestone13"
        },
        {
            "last_affected": "9.0.0-milestone13"
        },
        {
            "introduced": "9.0.0-milestone14"
        },
        {
            "last_affected": "9.0.0-milestone14"
        },
        {
            "introduced": "9.0.0-milestone15"
        },
        {
            "last_affected": "9.0.0-milestone15"
        },
        {
            "introduced": "9.0.0-milestone16"
        },
        {
            "last_affected": "9.0.0-milestone16"
        },
        {
            "introduced": "9.0.0-milestone17"
        },
        {
            "last_affected": "9.0.0-milestone17"
        },
        {
            "introduced": "9.0.0-milestone18"
        },
        {
            "last_affected": "9.0.0-milestone18"
        },
        {
            "introduced": "9.0.0-milestone19"
        },
        {
            "last_affected": "9.0.0-milestone19"
        },
        {
            "introduced": "9.0.0-milestone20"
        },
        {
            "last_affected": "9.0.0-milestone20"
        },
        {
            "introduced": "9.0.0-milestone21"
        },
        {
            "last_affected": "9.0.0-milestone21"
        },
        {
            "introduced": "9.0.0-milestone22"
        },
        {
            "last_affected": "9.0.0-milestone22"
        },
        {
            "introduced": "9.0.0-milestone23"
        },
        {
            "last_affected": "9.0.0-milestone23"
        },
        {
            "introduced": "9.0.0-milestone24"
        },
        {
            "last_affected": "9.0.0-milestone24"
        },
        {
            "introduced": "9.0.0-milestone25"
        },
        {
            "last_affected": "9.0.0-milestone25"
        },
        {
            "introduced": "9.0.0-milestone26"
        },
        {
            "last_affected": "9.0.0-milestone26"
        },
        {
            "introduced": "9.0.0-milestone27"
        },
        {
            "last_affected": "9.0.0-milestone27"
        },
        {
            "introduced": "9.0.0-milestone5"
        },
        {
            "last_affected": "9.0.0-milestone5"
        },
        {
            "introduced": "9.0.0-milestone6"
        },
        {
            "last_affected": "9.0.0-milestone6"
        },
        {
            "introduced": "9.0.0-milestone7"
        },
        {
            "last_affected": "9.0.0-milestone7"
        },
        {
            "introduced": "9.0.0-milestone8"
        },
        {
            "last_affected": "9.0.0-milestone8"
        },
        {
            "introduced": "9.0.0-milestone9"
        },
        {
            "last_affected": "9.0.0-milestone9"
        },
        {
            "introduced": "9.0.36"
        },
        {
            "last_affected": "9.0.36"
        },
        {
            "introduced": "9.0.37"
        },
        {
            "last_affected": "9.0.37"
        },
        {
            "introduced": "9.0.38"
        },
        {
            "last_affected": "9.0.38"
        },
        {
            "introduced": "9.0.39"
        },
        {
            "last_affected": "9.0.39"
        },
        {
            "introduced": "10.0.0-milestone1"
        },
        {
            "last_affected": "10.0.0-milestone1"
        },
        {
            "introduced": "10.0.0-milestone2"
        },
        {
            "last_affected": "10.0.0-milestone2"
        },
        {
            "introduced": "10.0.0-milestone3"
        },
        {
            "last_affected": "10.0.0-milestone3"
        },
        {
            "introduced": "10.0.0-milestone4"
        },
        {
            "last_affected": "10.0.0-milestone4"
        },
        {
            "introduced": "10.0.0-milestone5"
        },
        {
            "last_affected": "10.0.0-milestone5"
        },
        {
            "introduced": "10.0.0-milestone6"
        },
        {
            "last_affected": "10.0.0-milestone6"
        },
        {
            "introduced": "10.0.0-milestone7"
        },
        {
            "last_affected": "10.0.0-milestone7"
        },
        {
            "introduced": "10.0.0-milestone8"
        },
        {
            "last_affected": "10.0.0-milestone8"
        },
        {
            "introduced": "10.0.0-milestone9"
        },
        {
            "last_affected": "10.0.0-milestone9"
        }
    ],
    "cpe": [
        "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:9.0.0:milestone10:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:9.0.0:milestone11:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:9.0.0:milestone12:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:9.0.0:milestone13:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:9.0.0:milestone14:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:9.0.0:milestone15:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:9.0.0:milestone16:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:9.0.0:milestone17:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:9.0.0:milestone18:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:9.0.0:milestone19:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:9.0.0:milestone20:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:9.0.0:milestone21:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:9.0.0:milestone22:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:9.0.0:milestone23:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:9.0.0:milestone24:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:9.0.0:milestone25:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:9.0.0:milestone26:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:9.0.0:milestone27:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:9.0.0:milestone5:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:9.0.0:milestone6:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:9.0.0:milestone7:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:9.0.0:milestone8:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:9.0.0:milestone9:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:9.0.36:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:9.0.37:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:9.0.38:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:9.0.39:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:10.0.0:milestone1:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:10.0.0:milestone2:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:10.0.0:milestone3:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:10.0.0:milestone4:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:10.0.0:milestone5:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:10.0.0:milestone6:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:10.0.0:milestone7:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:10.0.0:milestone8:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:10.0.0:milestone9:*:*:*:*:*:*"
    ],
    "source": [
        "CPE_RANGE",
        "CPE_STRING"
    ]
}

Affected versions

10.*
10.0.0-milestone1
10.0.0-milestone2
10.0.0-milestone3
10.0.0-milestone4
10.0.0-milestone5
10.0.0-milestone6
10.0.0-milestone7
10.0.0-milestone8
10.0.0-milestone9
9.*
9.0.0-milestone10
9.0.0-milestone11
9.0.0-milestone12
9.0.0-milestone13
9.0.0-milestone14
9.0.0-milestone15
9.0.0-milestone16
9.0.0-milestone17
9.0.0-milestone18
9.0.0-milestone19
9.0.0-milestone20
9.0.0-milestone21
9.0.0-milestone22
9.0.0-milestone23
9.0.0-milestone24
9.0.0-milestone25
9.0.0-milestone26
9.0.0-milestone27
9.0.0-milestone5
9.0.0-milestone6
9.0.0-milestone7
9.0.0-milestone8
9.0.0-milestone9
9.0.36
9.0.37
9.0.38
9.0.39

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-17527.json"