CVE-2020-13934: Null Pointer Dereference
A flaw was found in Apache Tomcat, where an h2c direct connection did not release the HTTP/1.1 processor after the upgrade to HTTP/2. If a sufficient number of such requests are made, an OutOfMemoryException could occur, leading to a denial of service. The highest threat from this vulnerability is to system availability.
Other sources
A flaw was found in the Apache Tomcat, where an h2c direct connection did not release the HTTP/1.1 processor after the upgrade to HTTP/2. If a sufficient number of such requests were made, an OutOfMemoryException could occur leading to a denial of service.
It affects the version of Apache Tomcat 10.0.0-M1 to 10.0.0-M6, Apache Tomcat 9.0.0.M5 to 9.0.36, Apache Tomcat 8.5.1 to 8.5.56.
Upstream commits: Tomcat 10.0: https://github.com/apache/tomcat/commit/c9167ae30f3b03b112f3d81772e3450b7d0e6a25 Tomcat 9.0: https://github.com/apache/tomcat/commit/172977f04a5215128f1e278a688983dcd230f399 Tomcat 8.5: https://github.com/apache/tomcat/commit/923d834500802a61779318911d7898bd85fc950e
Reference: http://mail-archives.apache.org/modmbox/tomcat-announce/202007.mbox/%3Cad62f54e-8fd7-e326-25f1-3bdf1ffa3818%40apache.org%3E
— Red Hat
An h2c direct connection to Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36 and 8.5.1 to 8.5.56 did not release the HTTP/1.1 processor after the upgrade to HTTP/2. If a sufficient number of such requests were made, an OutOfMemoryException could occur leading to a denial of service.
Apache Tomcat is vulnerable to a denial of service, caused by not releasing the HTTP/1.1 processor after the upgrade to HTTP/2 in an h2c direct connection. By sending specially-crafted requests, a remote attacker could exploit this vulnerability to cause OutOfMemoryException resulting in a denial of service.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/jws5-tomcatto a version that resolves this vulnerability.Fixed in 0:9.0.30-5.redhat_6.1.el6 - Upgrade
Upgrade
redhat/jws5-tomcatto a version that resolves this vulnerability.Fixed in 0:9.0.30-5.redhat_6.1.el7 - Upgrade
Upgrade
redhat/jws5-tomcatto a version that resolves this vulnerability.Fixed in 0:9.0.30-5.redhat_6.1.el8 - Upgrade
Upgrade
redhat/tomcatto a version that resolves this vulnerability.Fixed in 10.0.0 - Upgrade
Upgrade
redhat/tomcatto a version that resolves this vulnerability.Fixed in 9.0.37 - Upgrade
Upgrade
redhat/tomcatto a version that resolves this vulnerability.Fixed in 8.5.57 - Upgrade
Upgrade
debian/tomcat9to a version that resolves this vulnerability.Fixed in 9.0.70-2Fixed in 9.0.95-1Fixed in 9.0.118-1 - Upgrade
Upgrade
Apache Tomcat 10.0to a version that resolves this vulnerability.Fixed in 10.0.0-M6 - Upgrade
Upgrade
Apache Tomcat 9.0to a version that resolves this vulnerability.Fixed in 9.0.36 - Upgrade
Upgrade
Apache Tomcat 8.5to a version that resolves this vulnerability.Fixed in 8.5.56
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2020-13934?
CVE-2020-13934 has been classified as a medium severity vulnerability due to the potential for denial of service from an OutOfMemoryException.
How do I fix CVE-2020-13934?
To mitigate CVE-2020-13934, upgrade to one of the fixed versions such as Apache Tomcat 8.5.57, 9.0.37, or 10.0.0.
Which versions of Apache Tomcat are affected by CVE-2020-13934?
CVE-2020-13934 affects Apache Tomcat versions from 8.5.1 to 8.5.56, and from 9.0.1 to 9.0.36.
What causes the vulnerability CVE-2020-13934?
CVE-2020-13934 is caused by an h2c direct connection not releasing the HTTP/1.1 processor after the upgrade to HTTP/2.
What impacts can CVE-2020-13934 have on my server?
If exploited, CVE-2020-13934 can lead to an OutOfMemoryException, resulting in a denial of service on the affected server.