| Package | Affected versions | Patched versions |
|---|---|---|
| org.apache.tomcat:tomcat-coyote | ≥ 10.0.0-M1, < 10.0.0-M10≥ 8.5.0, < 8.5.60≥ 9.0.0-M1, < 9.0.40 | 10.0.0-M108.5.609.0.40 |
| tomcat | = 10.0.0= 9.0.0= 9.0.35-3.39.1= 9.0.35-3.57.3= 9.0.36= 9.0.37= 9.0.38= 9.0.39≥ 8.5.1, ≤ 8.5.59≥ 9.0.1, ≤ 9.0.35 | |
| oncommand system manager | ≥ 3.0.0, ≤ 3.1.3 | |
| blockchain platform | < 21.1.2 | 21.1.2 |
| communications cloud native core binding support function | = 1.10.0 | |
| communications cloud native core policy | = 1.14.0 | |
| communications instant messaging server | = 10.0.1.5.0 | |
| instantis enterprisetrack | = 17.1= 17.2= 17.3 | |
| mysql enterprise monitor | < 8.0.23 | 8.0.23 |
| sd-wan edge | = 9.0 | |
| workload manager | = 18c= 19c |
While investigating bug 64830 it was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request header value from the previous stream received on an HTTP/2 connection for the request associated with the subsequent stream. While this would most likely lead to an error and the closure of the HTTP/2 connection, it is possible that information could leak between requests.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free