CVE-2020-13935
First published: Tue Jul 14 2020(Updated: )
The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid payload lengths could trigger an infinite loop. Multiple requests with invalid payload lengths could lead to a denial of service.
Credit: security@apache.org security@apache.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/tomcat | <0:7.0.76-15.el7 | 0:7.0.76-15.el7 |
| redhat/jbossweb | <0:7.5.31-2.Final_redhat_2.1.ep6.el5 | 0:7.5.31-2.Final_redhat_2.1.ep6.el5 |
| redhat/jbossweb | <0:7.5.31-2.Final_redhat_2.1.ep6.el6 | 0:7.5.31-2.Final_redhat_2.1.ep6.el6 |
| redhat/jboss-as-appclient | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jbossas-appclient | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jbossas-bundles | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jboss-as-cli | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jboss-as-client-all | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jboss-as-clustering | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jboss-as-cmp | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jboss-as-configadmin | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jboss-as-connector | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jboss-as-controller | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jboss-as-controller-client | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jbossas-core | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jboss-as-core-security | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jboss-as-deployment-repository | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jboss-as-deployment-scanner | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jbossas-domain | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jboss-as-domain-http | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jboss-as-domain-management | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jboss-as-ee | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jboss-as-ee-deployment | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jboss-as-ejb3 | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jboss-as-embedded | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jboss-as-host-controller | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jboss-as-jacorb | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jbossas-javadocs | <0:7.5.24-1.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-1.Final_redhat_00001.1.ep6.el6 |
| redhat/jboss-as-jaxr | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jboss-as-jaxrs | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jboss-as-jdr | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jboss-as-jmx | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jboss-as-jpa | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jboss-as-jsf | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jboss-as-jsr77 | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jboss-as-logging | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jboss-as-mail | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jboss-as-management-client-content | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jboss-as-messaging | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jboss-as-modcluster | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jbossas-modules-eap | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jboss-as-naming | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jboss-as-network | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jboss-as-osgi | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jboss-as-osgi-configadmin | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jboss-as-osgi-service | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jboss-as-picketlink | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jboss-as-platform-mbean | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jboss-as-pojo | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jboss-as-process-controller | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jbossas-product-eap | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jboss-as-protocol | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jboss-as-remoting | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jboss-as-sar | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jboss-as-security | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jboss-as-server | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jbossas-standalone | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jboss-as-system-jmx | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jboss-as-threads | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jboss-as-transactions | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jboss-as-version | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jboss-as-web | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jboss-as-webservices | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jbossas-welcome-content-eap | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jboss-as-weld | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jboss-as-xts | <0:7.5.24-2.Final_redhat_00001.1.ep6.el6 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el6 |
| redhat/jbossts | <1:4.17.45-2.Final_redhat_2.1.ep6.el6 | 1:4.17.45-2.Final_redhat_2.1.ep6.el6 |
| redhat/jbossweb | <0:7.5.32-2.Final_redhat_1.2.ep6.el6 | 0:7.5.32-2.Final_redhat_1.2.ep6.el6 |
| redhat/jbossweb | <0:7.5.31-2.Final_redhat_2.1.ep6.el7 | 0:7.5.31-2.Final_redhat_2.1.ep6.el7 |
| redhat/jboss-as-appclient | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jbossas-appclient | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jbossas-bundles | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jboss-as-cli | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jboss-as-client-all | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jboss-as-clustering | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jboss-as-cmp | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jboss-as-configadmin | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jboss-as-connector | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jboss-as-controller | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jboss-as-controller-client | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jbossas-core | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jboss-as-core-security | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jboss-as-deployment-repository | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jboss-as-deployment-scanner | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jbossas-domain | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jboss-as-domain-http | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jboss-as-domain-management | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jboss-as-ee | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jboss-as-ee-deployment | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jboss-as-ejb3 | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jboss-as-embedded | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jboss-as-host-controller | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jboss-as-jacorb | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jbossas-javadocs | <0:7.5.24-1.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-1.Final_redhat_00001.1.ep6.el7 |
| redhat/jboss-as-jaxr | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jboss-as-jaxrs | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jboss-as-jdr | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jboss-as-jmx | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jboss-as-jpa | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jboss-as-jsf | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jboss-as-jsr77 | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jboss-as-logging | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jboss-as-mail | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jboss-as-management-client-content | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jboss-as-messaging | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jboss-as-modcluster | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jbossas-modules-eap | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jboss-as-naming | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jboss-as-network | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jboss-as-osgi | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jboss-as-osgi-configadmin | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jboss-as-osgi-service | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jboss-as-picketlink | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jboss-as-platform-mbean | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jboss-as-pojo | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jboss-as-process-controller | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jbossas-product-eap | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jboss-as-protocol | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jboss-as-remoting | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jboss-as-sar | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jboss-as-security | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jboss-as-server | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jbossas-standalone | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jboss-as-system-jmx | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jboss-as-threads | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jboss-as-transactions | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jboss-as-version | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jboss-as-web | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jboss-as-webservices | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jbossas-welcome-content-eap | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jboss-as-weld | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jboss-as-xts | <0:7.5.24-2.Final_redhat_00001.1.ep6.el7 | 0:7.5.24-2.Final_redhat_00001.1.ep6.el7 |
| redhat/jbossts | <1:4.17.45-2.Final_redhat_2.1.ep6.el7 | 1:4.17.45-2.Final_redhat_2.1.ep6.el7 |
| redhat/jbossweb | <0:7.5.32-2.Final_redhat_1.2.ep6.el7 | 0:7.5.32-2.Final_redhat_1.2.ep6.el7 |
| redhat/tomcat7 | <0:7.0.70-41.ep7.el6 | 0:7.0.70-41.ep7.el6 |
| redhat/tomcat8 | <0:8.0.36-45.ep7.el6 | 0:8.0.36-45.ep7.el6 |
| redhat/tomcat7 | <0:7.0.70-41.ep7.el7 | 0:7.0.70-41.ep7.el7 |
| redhat/tomcat8 | <0:8.0.36-45.ep7.el7 | 0:8.0.36-45.ep7.el7 |
| redhat/jws5-tomcat | <0:9.0.30-5.redhat_6.1.el6 | 0:9.0.30-5.redhat_6.1.el6 |
| redhat/jws5-tomcat | <0:9.0.30-5.redhat_6.1.el7 | 0:9.0.30-5.redhat_6.1.el7 |
| redhat/jws5-tomcat | <0:9.0.30-5.redhat_6.1.el8 | 0:9.0.30-5.redhat_6.1.el8 |
| redhat/tomcat | <10.0.0 | 10.0.0 |
| redhat/tomcat | <9.0.37 | 9.0.37 |
| redhat/tomcat | <8.5.57 | 8.5.57 |
| redhat/tomcat | <7.0.105 | 7.0.105 |
| maven/org.apache.tomcat:tomcat | >=7.0.27<7.0.105 | 7.0.105 |
| maven/org.apache.tomcat:tomcat | >=8.5.0<8.5.57 | 8.5.57 |
| maven/org.apache.tomcat:tomcat | >=9.0.0.M1<9.0.37 | 9.0.37 |
| maven/org.apache.tomcat:tomcat | >=10.0.0-M1<10.0.0-M7 | 10.0.0-M7 |
| ubuntu/tomcat8 | <8.0.32-1ubuntu1.13 | 8.0.32-1ubuntu1.13 |
| ubuntu/tomcat9 | <9.0.31-1ubuntu0.1 | 9.0.31-1ubuntu0.1 |
| debian/tomcat9 | 9.0.31-1~deb10u6 9.0.31-1~deb10u12 9.0.43-2~deb11u9 9.0.43-2~deb11u10 9.0.70-2 | |
| Apache Tomcat | >=7.0.27<=7.0.104 | |
| Apache Tomcat | >=8.5.0<=8.5.56 | |
| Apache Tomcat | >=9.0.1<=9.0.36 | |
| Apache Tomcat | =9.0.0-milestone1 | |
| Apache Tomcat | =9.0.0-milestone10 | |
| Apache Tomcat | =9.0.0-milestone11 | |
| Apache Tomcat | =9.0.0-milestone12 | |
| Apache Tomcat | =9.0.0-milestone13 | |
| Apache Tomcat | =9.0.0-milestone14 | |
| Apache Tomcat | =9.0.0-milestone15 | |
| Apache Tomcat | =9.0.0-milestone16 | |
| Apache Tomcat | =9.0.0-milestone17 | |
| Apache Tomcat | =9.0.0-milestone18 | |
| Apache Tomcat | =9.0.0-milestone19 | |
| Apache Tomcat | =9.0.0-milestone2 | |
| Apache Tomcat | =9.0.0-milestone20 | |
| Apache Tomcat | =9.0.0-milestone21 | |
| Apache Tomcat | =9.0.0-milestone22 | |
| Apache Tomcat | =9.0.0-milestone23 | |
| Apache Tomcat | =9.0.0-milestone24 | |
| Apache Tomcat | =9.0.0-milestone25 | |
| Apache Tomcat | =9.0.0-milestone26 | |
| Apache Tomcat | =9.0.0-milestone27 | |
| Apache Tomcat | =9.0.0-milestone3 | |
| Apache Tomcat | =9.0.0-milestone4 | |
| Apache Tomcat | =9.0.0-milestone5 | |
| Apache Tomcat | =9.0.0-milestone6 | |
| Apache Tomcat | =9.0.0-milestone7 | |
| Apache Tomcat | =9.0.0-milestone8 | |
| Apache Tomcat | =9.0.0-milestone9 | |
| Apache Tomcat | =10.0.0-milestone1 | |
| Apache Tomcat | =10.0.0-milestone2 | |
| Apache Tomcat | =10.0.0-milestone3 | |
| Apache Tomcat | =10.0.0-milestone4 | |
| Apache Tomcat | =10.0.0-milestone5 | |
| Apache Tomcat | =10.0.0-milestone6 | |
| Debian Debian Linux | =9.0 | |
| Debian Debian Linux | =10.0 | |
| NetApp OnCommand System Manager | >=3.0.0<=3.1.3 | |
| openSUSE Leap | =15.1 | |
| openSUSE Leap | =15.2 | |
| Canonical Ubuntu Linux | =16.04 | |
| Canonical Ubuntu Linux | =20.04 | |
| McAfee ePolicy Orchestrator | =5.9.0 | |
| McAfee ePolicy Orchestrator | =5.9.1 | |
| McAfee ePolicy Orchestrator | =5.10.0 | |
| McAfee ePolicy Orchestrator | =5.10.0-update_1 | |
| McAfee ePolicy Orchestrator | =5.10.0-update_2 | |
| McAfee ePolicy Orchestrator | =5.10.0-update_3 | |
| McAfee ePolicy Orchestrator | =5.10.0-update_4 | |
| McAfee ePolicy Orchestrator | =5.10.0-update_5 | |
| McAfee ePolicy Orchestrator | =5.10.0-update_6 | |
| McAfee ePolicy Orchestrator | =5.10.0-update_7 | |
| McAfee ePolicy Orchestrator | =5.10.0-update_8 | |
| Oracle Agile Engineering Data Management | =6.2.1.0 | |
| Oracle Agile PLM | =9.3.3 | |
| Oracle Agile PLM | =9.3.5 | |
| Oracle Agile PLM | =9.3.6 | |
| Oracle Blockchain Platform | <21.1.2 | |
| Oracle Commerce Guided Search | =11.3.2 | |
| Oracle Communications Cloud Native Core Policy | =1.14.0 | |
| Oracle Communications Instant Messaging Server | =10.0.1.5.0 | |
| Oracle Fmw Platform | =12.2.1.3.0 | |
| Oracle Fmw Platform | =12.2.1.4.0 | |
| Oracle Instantis Enterprisetrack | =17.1 | |
| Oracle Instantis Enterprisetrack | =17.2 | |
| Oracle Instantis Enterprisetrack | =17.3 | |
| Oracle Managed File Transfer | =12.2.1.3.0 | |
| Oracle Managed File Transfer | =12.2.1.4.0 | |
| Oracle Mysql Enterprise Monitor | <=8.0.21 | |
| Oracle Siebel Ui Framework | <=20.12 | |
| Oracle Workload Manager | =12.2.0.1 | |
| Oracle Workload Manager | =18c | |
| Oracle Workload Manager | =19c |
Remedy
Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update as soon as possible.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.cve.org/CVERecord?id=CVE-2020-13935 https://nvd.nist.gov/vuln/detail/CVE-2020-13935 http://mail-archives.apache.org/mod_mbox/tomcat-announce/202007.mbox/%3C39e4200c-6f4e-b85d-fe4b-a9c2bd5fdc3d%40apache.org%3E http://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.0.0-M7 http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.105 http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.57 http://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.37
- https://bugzilla.redhat.com/show_bug.cgi?id=1857024
- https://access.redhat.com/errata/RHSA-2022:5458
- https://access.redhat.com/errata/RHSA-2020:4004
- https://access.redhat.com/errata/RHSA-2020:3382
- https://access.redhat.com/errata/RHSA-2020:3383
- https://access.redhat.com/errata/RHSA-2022:5459
- https://access.redhat.com/errata/RHSA-2022:5460
- https://access.redhat.com/errata/RHSA-2021:3140
- https://access.redhat.com/errata/RHSA-2020:3305
- https://access.redhat.com/errata/RHSA-2020:3303
- https://access.redhat.com/errata/RHSA-2020:3306
- https://access.redhat.com/errata/RHSA-2020:3308
- https://access.redhat.com/errata/RHSA-2020:3806
- https://access.redhat.com/security/cve/cve-2020-13935
- https://lists.apache.org/thread.html/rd48c72bd3255bda87564d4da3791517c074d94f8a701f93b85752651%40%3Cannounce.tomcat.apache.org%3E
- https://www.debian.org/security/2020/dsa-4727
- https://lists.debian.org/debian-lts-announce/2020/07/msg00017.html
- https://security.netapp.com/advisory/ntap-20200724-0003/
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00084.html
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00088.html
- https://usn.ubuntu.com/4448-1/
- https://kc.mcafee.com/corporate/index?page=content&id=SB10332
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://usn.ubuntu.com/4596-1/
- https://lists.apache.org/thread.html/r4e5d3c09f4dd2923191e972408b40fb8b42dbff0bc7904d44b651e50@%3Cusers.tomcat.apache.org%3E
- https://www.oracle.com/security-alerts/cpujan2021.html
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://launchpad.net/bugs/cve/CVE-2020-13935
- https://github.com/apache/tomcat/commit/1c1c77b0efb667cea80b532440b44cea1dc427c3
- https://github.com/apache/tomcat/commit/40fa74c74822711ab878079d0a69f7357926723d
- https://github.com/apache/tomcat/commit/12d715676038efbf9c728af10163f8277fc019d5
- https://github.com/apache/tomcat/commit/f9f75c14678b68633f79030ddf4ff827f014cc84
- https://github.com/apache/tomcat/commit/4c04982870d6e730c38e21e58fb653b7cf723784
- http://mail-archives.apache.org/mod_mbox/tomcat-announce/202007.mbox/%3C39e4200c-6f4e-b85d-fe4b-a9c2bd5fdc3d%40apache.org%3E
- http://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.0.0-M7
- http://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.37
- http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.57
- http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.105
- https://access.redhat.com/support/policy/updates/jboss_notes
- https://access.redhat.com/support/policy/updates/rhscl
- https://access.redhat.com/support/policy/updates/rhscl-rhel7
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1867432
- https://kc.mcafee.com/corporate/index?page=content&id=SB10332
- https://lists.apache.org/thread.html/r4e5d3c09f4dd2923191e972408b40fb8b42dbff0bc7904d44b651e50%40%3Cusers.tomcat.apache.org%3E
- https://nvd.nist.gov/vuln/detail/CVE-2020-13935
- https://usn.ubuntu.com/4596-1
- https://usn.ubuntu.com/4448-1
- https://security.netapp.com/advisory/ntap-20200724-0003
- https://tomcat.apache.org/security-9.html
- https://tomcat.apache.org/security-8.html
- https://tomcat.apache.org/security-7.html
- https://tomcat.apache.org/security-10.html
- https://github.com/advisories/GHSA-m7jv-hq7h-mq7c (Advisory)
- https://www.openwall.com/lists/oss-security/2020/07/14/3
- https://security-tracker.debian.org/tracker/CVE-2020-13935
- https://ubuntu.com/security/notices/USN-4448-1
- https://ubuntu.com/security/notices/USN-4596-1
- https://www.cve.org/CVERecord?id=CVE-2020-13935
- https://ubuntu.com/security/CVE-2020-13935
Parent vulnerabilities
(Appears in the following advisories)
- collector/redhat-cve
- agent/type
- agent/first-publish-date
- collector/launchpad-cve
- source/Launchpad
- agent/author
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2020-13935
- agent/software-canonical-lookup
- agent/weakness
- agent/remedy
- agent/severity
- agent/description
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-m7jv-hq7h-mq7c
- agent/last-modified-date
- agent/event
- collector/github-advisory
- collector/usn-cve
- source/Ubuntu
- agent/references
- collector/security-tracker-debian
- source/Debian
- agent/softwarecombine
- agent/tags
- collector/nvd-cve
- source/NVD
- agent/software-canonical-lookup-request
- collector/nvd-index
- package-manager/redhat
- package-manager/maven
- package-manager/ubuntu
- package-manager/debian
- vendor/apache
- canonical/apache tomcat
- version/apache tomcat/7.0.27
- version/apache tomcat/7.0.104
- version/apache tomcat/8.5.0
- version/apache tomcat/8.5.56
- version/apache tomcat/9.0.1
- version/apache tomcat/9.0.36
- version/apache tomcat/9.0.0-milestone1
- version/apache tomcat/9.0.0-milestone10
- version/apache tomcat/9.0.0-milestone11
- version/apache tomcat/9.0.0-milestone12
- version/apache tomcat/9.0.0-milestone13
- version/apache tomcat/9.0.0-milestone14
- version/apache tomcat/9.0.0-milestone15
- version/apache tomcat/9.0.0-milestone16
- version/apache tomcat/9.0.0-milestone17
- version/apache tomcat/9.0.0-milestone18
- version/apache tomcat/9.0.0-milestone19
- version/apache tomcat/9.0.0-milestone2
- version/apache tomcat/9.0.0-milestone20
- version/apache tomcat/9.0.0-milestone21
- version/apache tomcat/9.0.0-milestone22
- version/apache tomcat/9.0.0-milestone23
- version/apache tomcat/9.0.0-milestone24
- version/apache tomcat/9.0.0-milestone25
- version/apache tomcat/9.0.0-milestone26
- version/apache tomcat/9.0.0-milestone27
- version/apache tomcat/9.0.0-milestone3
- version/apache tomcat/9.0.0-milestone4
- version/apache tomcat/9.0.0-milestone5
- version/apache tomcat/9.0.0-milestone6
- version/apache tomcat/9.0.0-milestone7
- version/apache tomcat/9.0.0-milestone8
- version/apache tomcat/9.0.0-milestone9
- version/apache tomcat/10.0.0-milestone1
- version/apache tomcat/10.0.0-milestone2
- version/apache tomcat/10.0.0-milestone3
- version/apache tomcat/10.0.0-milestone4
- version/apache tomcat/10.0.0-milestone5
- version/apache tomcat/10.0.0-milestone6
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/9.0
- version/debian debian linux/10.0
- vendor/netapp
- canonical/netapp oncommand system manager
- version/netapp oncommand system manager/3.0.0
- version/netapp oncommand system manager/3.1.3
- vendor/opensuse
- canonical/opensuse leap
- version/opensuse leap/15.1
- version/opensuse leap/15.2
- vendor/canonical
- canonical/canonical ubuntu linux
- version/canonical ubuntu linux/16.04
- version/canonical ubuntu linux/20.04
- vendor/mcafee
- canonical/mcafee epolicy orchestrator
- version/mcafee epolicy orchestrator/5.9.0
- version/mcafee epolicy orchestrator/5.9.1
- version/mcafee epolicy orchestrator/5.10.0
- version/mcafee epolicy orchestrator/5.10.0-update_1
- version/mcafee epolicy orchestrator/5.10.0-update_2
- version/mcafee epolicy orchestrator/5.10.0-update_3
- version/mcafee epolicy orchestrator/5.10.0-update_4
- version/mcafee epolicy orchestrator/5.10.0-update_5
- version/mcafee epolicy orchestrator/5.10.0-update_6
- version/mcafee epolicy orchestrator/5.10.0-update_7
- version/mcafee epolicy orchestrator/5.10.0-update_8
- vendor/oracle
- canonical/oracle agile engineering data management
- version/oracle agile engineering data management/6.2.1.0
- canonical/oracle agile plm
- version/oracle agile plm/9.3.3
- version/oracle agile plm/9.3.5
- version/oracle agile plm/9.3.6
- canonical/oracle blockchain platform
- canonical/oracle commerce guided search
- version/oracle commerce guided search/11.3.2
- canonical/oracle communications cloud native core policy
- version/oracle communications cloud native core policy/1.14.0
- canonical/oracle communications instant messaging server
- version/oracle communications instant messaging server/10.0.1.5.0
- canonical/oracle fmw platform
- version/oracle fmw platform/12.2.1.3.0
- version/oracle fmw platform/12.2.1.4.0
- canonical/oracle instantis enterprisetrack
- version/oracle instantis enterprisetrack/17.1
- version/oracle instantis enterprisetrack/17.2
- version/oracle instantis enterprisetrack/17.3
- canonical/oracle managed file transfer
- version/oracle managed file transfer/12.2.1.3.0
- version/oracle managed file transfer/12.2.1.4.0
- canonical/oracle mysql enterprise monitor
- version/oracle mysql enterprise monitor/8.0.21
- canonical/oracle siebel ui framework
- version/oracle siebel ui framework/20.12
- canonical/oracle workload manager
- version/oracle workload manager/12.2.0.1
- version/oracle workload manager/18c
- version/oracle workload manager/19c