En bref
- CVE-2017-5650 est une vulnérabilité ÉLEVÉE (CVSS 7.5) touchant org.apache.tomcat:tomcat, tomcat (apache).
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 8.3%, plus élevée que 94.9% des vulnérabilités.
- Correctif : mettre à jour vers 8.5.13, 9.0.0.M19 ou plus récent.
| Package | Affected versions | Patched versions |
|---|
| org.apache.tomcat:tomcat Maven | ≥ 8.5.0, < 8.5.13≥ 9.0.0.M1, < 9.0.0.M19
| 8.5.139.0.0.M19
|
| tomcat | = 8.5.0= 8.5.1= 8.5.10= 8.5.11= 8.5.12= 8.5.2= 8.5.3= 8.5.4= 8.5.5= 8.5.6= 8.5.7= 8.5.8= 8.5.9= 9.0.0
| No fix yet |
Description
In Apache Tomcat 9.0.0.M1 to 9.0.0.M18 and 8.5.0 to 8.5.12, the handling of an HTTP/2 GOAWAY frame for a connection did not close streams associated with that connection that were currently waiting for a WINDOW_UPDATE before allowing the application to write more data. These waiting streams each consumed a thread. A malicious client could therefore construct a series of HTTP/2 requests that would consume all available processing threads.
NVD description
In Apache Tomcat 9.0.0.M1 to 9.0.0.M18 and 8.5.0 to 8.5.12, the handling of an HTTP/2 GOAWAY frame for a connection did not close streams associated with that connection that were currently waiting for a WINDOW_UPDATE before allowing the application to write more data. These waiting streams each consumed a thread. A malicious client could therefore construct a series of HTTP/2 requests that would consume all available processing threads.
Autres vulnérabilités de org.apache.tomcat:tomcat
Tout voir →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free