A vulnerability has been discovered in Apache Tomcat that allows for the disclosure of sensitive information.
Package | www-servers/tomcat on all architectures |
---|---|
Affected versions | < 8.5.60 < 9.0.40 |
Unaffected versions | >= 8.5.60 >= 9.0.40 |
Apache Tomcat is a Servlet-3.0/JSP-2.2 Container.
It was discovered that Apache Tomcat could re-use an HTTP request header value from the previous stream received on an HTTP/2 connection for the request associated with the subsequent stream.
A remote attacker, by sending well-timed HTTP/2 requests, could possibly obtain sensitive information.
Disable HTTP/2 support.
All Apache Tomcat 8.5.x users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=www-servers/tomcat-8.5.60:8.5"
All Apache Tomcat 9.x users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=www-servers/tomcat-9.0.40:9"
Release date
December 24, 2020
Latest revision
December 24, 2020: 1
Severity
low
Exploitable
remote
Bugzilla entries