CVE-2020-13934: Null Pointer Dereference
First published: Tue Jul 14 2020(Updated: )
A flaw was found in Apache Tomcat, where an h2c direct connection did not release the HTTP/1.1 processor after the upgrade to HTTP/2. If a sufficient number of such requests are made, an OutOfMemoryException could occur, leading to a denial of service. The highest threat from this vulnerability is to system availability.
Credit: security@apache.org security@apache.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/jws5-tomcat | <0:9.0.30-5.redhat_6.1.el6 | 0:9.0.30-5.redhat_6.1.el6 |
| redhat/jws5-tomcat | <0:9.0.30-5.redhat_6.1.el7 | 0:9.0.30-5.redhat_6.1.el7 |
| redhat/jws5-tomcat | <0:9.0.30-5.redhat_6.1.el8 | 0:9.0.30-5.redhat_6.1.el8 |
| redhat/tomcat | <10.0.0 | 10.0.0 |
| redhat/tomcat | <9.0.37 | 9.0.37 |
| redhat/tomcat | <8.5.57 | 8.5.57 |
| IBM IBM® Engineering Requirements Management DOORS | <=9.7.2.7 | |
| IBM IBM® Engineering Requirements Management DOORS Web Access | <=9.7.2.7 | |
| ubuntu/tomcat9 | <9.0.31-1ubuntu0.1 | 9.0.31-1ubuntu0.1 |
| debian/tomcat9 | 9.0.31-1~deb10u6 9.0.31-1~deb10u12 9.0.43-2~deb11u9 9.0.43-2~deb11u10 9.0.70-2 | |
| Apache Tomcat | >=8.5.1<=8.5.56 | |
| Apache Tomcat | >=9.0.1<=9.0.36 | |
| Apache Tomcat | =9.0.0-milestone10 | |
| Apache Tomcat | =9.0.0-milestone11 | |
| Apache Tomcat | =9.0.0-milestone12 | |
| Apache Tomcat | =9.0.0-milestone13 | |
| Apache Tomcat | =9.0.0-milestone14 | |
| Apache Tomcat | =9.0.0-milestone15 | |
| Apache Tomcat | =9.0.0-milestone16 | |
| Apache Tomcat | =9.0.0-milestone17 | |
| Apache Tomcat | =9.0.0-milestone18 | |
| Apache Tomcat | =9.0.0-milestone19 | |
| Apache Tomcat | =9.0.0-milestone20 | |
| Apache Tomcat | =9.0.0-milestone21 | |
| Apache Tomcat | =9.0.0-milestone22 | |
| Apache Tomcat | =9.0.0-milestone23 | |
| Apache Tomcat | =9.0.0-milestone24 | |
| Apache Tomcat | =9.0.0-milestone25 | |
| Apache Tomcat | =9.0.0-milestone26 | |
| Apache Tomcat | =9.0.0-milestone27 | |
| Apache Tomcat | =9.0.0-milestone5 | |
| Apache Tomcat | =9.0.0-milestone6 | |
| Apache Tomcat | =9.0.0-milestone7 | |
| Apache Tomcat | =9.0.0-milestone8 | |
| Apache Tomcat | =9.0.0-milestone9 | |
| Apache Tomcat | =10.0.0-milestone1 | |
| Apache Tomcat | =10.0.0-milestone2 | |
| Apache Tomcat | =10.0.0-milestone3 | |
| Apache Tomcat | =10.0.0-milestone4 | |
| Apache Tomcat | =10.0.0-milestone5 | |
| Apache Tomcat | =10.0.0-milestone6 | |
| Debian Debian Linux | =9.0 | |
| Debian Debian Linux | =10.0 | |
| NetApp OnCommand System Manager | >=3.0.0<=3.1.3 | |
| openSUSE Leap | =15.1 | |
| openSUSE Leap | =15.2 | |
| Canonical Ubuntu Linux | =20.04 | |
| Oracle Agile Engineering Data Management | =6.2.1.0 | |
| Oracle Agile PLM | =9.3.3 | |
| Oracle Agile PLM | =9.3.5 | |
| Oracle Agile PLM | =9.3.6 | |
| Oracle Communications Instant Messaging Server | =10.0.1.5.0 | |
| Oracle Fmw Platform | =12.2.1.3.0 | |
| Oracle Fmw Platform | =12.2.1.4.0 | |
| Oracle Instantis Enterprisetrack | =17.1 | |
| Oracle Instantis Enterprisetrack | =17.2 | |
| Oracle Instantis Enterprisetrack | =17.3 | |
| Oracle Managed File Transfer | =12.2.1.3.0 | |
| Oracle Managed File Transfer | =12.2.1.4.0 | |
| Oracle Mysql Enterprise Monitor | <=8.0.21 | |
| Oracle Siebel Ui Framework | <=20.12 | |
| Oracle Workload Manager | =12.2.0.1 | |
| Oracle Workload Manager | =18c | |
| Oracle Workload Manager | =19c |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.cve.org/CVERecord?id=CVE-2020-13934 https://nvd.nist.gov/vuln/detail/CVE-2020-13934 http://mail-archives.apache.org/mod_mbox/tomcat-announce/202007.mbox/%3Cad62f54e-8fd7-e326-25f1-3bdf1ffa3818%40apache.org%3E http://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.0.0-M7 http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.105 http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.57 http://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.37
- https://bugzilla.redhat.com/show_bug.cgi?id=1857040
- https://access.redhat.com/errata/RHSA-2021:3140
- https://access.redhat.com/errata/RHSA-2020:3306
- https://access.redhat.com/errata/RHSA-2020:3308
- https://access.redhat.com/errata/RHSA-2020:3806
- https://access.redhat.com/security/cve/cve-2020-13934
- https://lists.apache.org/thread.html/r61f411cf82488d6ec213063fc15feeeb88e31b0ca9c29652ee4f962e%40%3Cannounce.tomcat.apache.org%3E
- https://www.debian.org/security/2020/dsa-4727
- https://lists.debian.org/debian-lts-announce/2020/07/msg00017.html
- https://security.netapp.com/advisory/ntap-20200724-0003/
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00084.html
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00088.html
- https://lists.apache.org/thread.html/ra072b1f786e7d139e86f1d1145572e0ff71cef38a96d9c6f5362aac8@%3Cdev.tomcat.apache.org%3E
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://usn.ubuntu.com/4596-1/
- https://www.oracle.com/security-alerts/cpujan2021.html
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://launchpad.net/bugs/cve/CVE-2020-13934
- https://github.com/apache/tomcat/commit/c9167ae30f3b03b112f3d81772e3450b7d0e6a25
- https://github.com/apache/tomcat/commit/172977f04a5215128f1e278a688983dcd230f399
- https://github.com/apache/tomcat/commit/923d834500802a61779318911d7898bd85fc950e
- http://mail-archives.apache.org/mod_mbox/tomcat-announce/202007.mbox/%3Cad62f54e-8fd7-e326-25f1-3bdf1ffa3818%40apache.org%3E
- http://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.0.0-M7
- http://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.37
- http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.57
- http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.105
- https://access.redhat.com/support/policy/updates/jboss_notes
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1867433
- https://lists.apache.org/thread.html/ra072b1f786e7d139e86f1d1145572e0ff71cef38a96d9c6f5362aac8%40%3Cdev.tomcat.apache.org%3E
- https://exchange.xforce.ibmcloud.com/vulnerabilities/185239
- https://www.ibm.com/support/pages/node/7124058 (Advisory)
- https://www.openwall.com/lists/oss-security/2020/07/14/4
- https://security-tracker.debian.org/tracker/CVE-2020-13934
- https://ubuntu.com/security/notices/USN-4596-1
- https://www.cve.org/CVERecord?id=CVE-2020-13934
- https://nvd.nist.gov/vuln/detail/CVE-2020-13934
- https://ubuntu.com/security/CVE-2020-13934
Parent vulnerabilities
(Appears in the following advisories)
- collector/redhat-cve
- agent/type
- agent/first-publish-date
- collector/launchpad-cve
- source/Launchpad
- agent/author
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2020-13934
- agent/software-canonical-lookup
- agent/weakness
- agent/event
- agent/severity
- agent/last-modified-date
- agent/description
- collector/ibm-support
- source/IBM
- agent/software-canonical-lookup-request
- collector/usn-cve
- source/Ubuntu
- agent/remedy
- agent/references
- collector/security-tracker-debian
- source/Debian
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- collector/nvd-cve
- source/NVD
- package-manager/redhat
- vendor/ibm
- canonical/ibm ibm® engineering requirements management doors
- version/ibm ibm® engineering requirements management doors/9.7.2.7
- canonical/ibm ibm® engineering requirements management doors web access
- version/ibm ibm® engineering requirements management doors web access/9.7.2.7
- package-manager/ubuntu
- package-manager/debian
- vendor/apache
- canonical/apache tomcat
- version/apache tomcat/8.5.1
- version/apache tomcat/8.5.56
- version/apache tomcat/9.0.1
- version/apache tomcat/9.0.36
- version/apache tomcat/9.0.0-milestone10
- version/apache tomcat/9.0.0-milestone11
- version/apache tomcat/9.0.0-milestone12
- version/apache tomcat/9.0.0-milestone13
- version/apache tomcat/9.0.0-milestone14
- version/apache tomcat/9.0.0-milestone15
- version/apache tomcat/9.0.0-milestone16
- version/apache tomcat/9.0.0-milestone17
- version/apache tomcat/9.0.0-milestone18
- version/apache tomcat/9.0.0-milestone19
- version/apache tomcat/9.0.0-milestone20
- version/apache tomcat/9.0.0-milestone21
- version/apache tomcat/9.0.0-milestone22
- version/apache tomcat/9.0.0-milestone23
- version/apache tomcat/9.0.0-milestone24
- version/apache tomcat/9.0.0-milestone25
- version/apache tomcat/9.0.0-milestone26
- version/apache tomcat/9.0.0-milestone27
- version/apache tomcat/9.0.0-milestone5
- version/apache tomcat/9.0.0-milestone6
- version/apache tomcat/9.0.0-milestone7
- version/apache tomcat/9.0.0-milestone8
- version/apache tomcat/9.0.0-milestone9
- version/apache tomcat/10.0.0-milestone1
- version/apache tomcat/10.0.0-milestone2
- version/apache tomcat/10.0.0-milestone3
- version/apache tomcat/10.0.0-milestone4
- version/apache tomcat/10.0.0-milestone5
- version/apache tomcat/10.0.0-milestone6
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/9.0
- version/debian debian linux/10.0
- vendor/netapp
- canonical/netapp oncommand system manager
- version/netapp oncommand system manager/3.0.0
- version/netapp oncommand system manager/3.1.3
- vendor/opensuse
- canonical/opensuse leap
- version/opensuse leap/15.1
- version/opensuse leap/15.2
- vendor/canonical
- canonical/canonical ubuntu linux
- version/canonical ubuntu linux/20.04
- vendor/oracle
- canonical/oracle agile engineering data management
- version/oracle agile engineering data management/6.2.1.0
- canonical/oracle agile plm
- version/oracle agile plm/9.3.3
- version/oracle agile plm/9.3.5
- version/oracle agile plm/9.3.6
- canonical/oracle communications instant messaging server
- version/oracle communications instant messaging server/10.0.1.5.0
- canonical/oracle fmw platform
- version/oracle fmw platform/12.2.1.3.0
- version/oracle fmw platform/12.2.1.4.0
- canonical/oracle instantis enterprisetrack
- version/oracle instantis enterprisetrack/17.1
- version/oracle instantis enterprisetrack/17.2
- version/oracle instantis enterprisetrack/17.3
- canonical/oracle managed file transfer
- version/oracle managed file transfer/12.2.1.3.0
- version/oracle managed file transfer/12.2.1.4.0
- canonical/oracle mysql enterprise monitor
- version/oracle mysql enterprise monitor/8.0.21
- canonical/oracle siebel ui framework
- version/oracle siebel ui framework/20.12
- canonical/oracle workload manager
- version/oracle workload manager/12.2.0.1
- version/oracle workload manager/18c
- version/oracle workload manager/19c