Bugzilla – Bug 1139924
VUL-0: CVE-2019-10072: tomcat: HTTP/2 connection window exhaustion on write
Last modified: 2020-07-10 13:58:09 UTC
CVE-2019-10072 The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write. By not sending WINDOW_UPDATE messages for the connection window (stream 0) clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS. References: http://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.20 http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.41 http://mail-archives.us.apache.org/mod_mbox/www-announce/201906.mbox/%3Cca69531a-1592-be7b-60ce-729549c7f812%40apache.org%3E Upstream commits: Tomcat 9.0: https://github.com/apache/tomcat/commit/7f748eb https://github.com/apache/tomcat/commit/ada725a Tomcat 8.5 https://github.com/apache/tomcat/commit/0bcd69c https://github.com/apache/tomcat/commit/8d14c6f References: https://bugzilla.redhat.com/show_bug.cgi?id=1723708 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-10072 http://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-10072.html http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10072 https://www.zerodayinitiative.com/advisories/ZDI-19-582/ http://www.cvedetails.com/cve/CVE-2019-10072/ https://lists.apache.org/thread.html/df1a2c1b87c8a6c500ecdbbaf134c7f1491c8d79d98b48c6b9f0fa6a@%3Cannounce.tomcat.apache.org%3E
This is related to bsc#1131055. Affected codestreams are: SLE-12-SP4:Update SLE-15:Update SLE-15-SP1:Update The related upstream commits can be found at comment 0
SUSE-SU-2019:1825-1: An update that fixes one vulnerability is now available. Category: security (moderate) Bug References: 1139924 CVE References: CVE-2019-0199 Sources used: SUSE Linux Enterprise Module for Web Scripting 15 (src): tomcat-9.0.21-3.27.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 (src): tomcat-9.0.21-3.27.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2019:1866-1: An update that fixes three vulnerabilities is now available. Category: security (moderate) Bug References: 1131055,1136085,1139924 CVE References: CVE-2019-0199,CVE-2019-0221,CVE-2019-10072 Sources used: SUSE Linux Enterprise Server 12-SP4 (src): tomcat-9.0.21-3.13.2 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
openSUSE-SU-2019:1723-1: An update that fixes one vulnerability is now available. Category: security (moderate) Bug References: 1139924 CVE References: CVE-2019-0199 Sources used: openSUSE Leap 15.0 (src): tomcat-9.0.21-lp150.2.22.1
SUSE-SU-2020:0029-1: An update that fixes three vulnerabilities is now available. Category: security (important) Bug References: 1139924,1159723,1159729 CVE References: CVE-2019-10072,CVE-2019-12418,CVE-2019-17563 Sources used: SUSE Linux Enterprise Module for Web Scripting 15-SP1 (src): tomcat-9.0.30-4.10.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15-SP1 (src): tomcat-9.0.30-4.10.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
openSUSE-SU-2020:0038-1: An update that fixes three vulnerabilities is now available. Category: security (important) Bug References: 1139924,1159723,1159729 CVE References: CVE-2019-10072,CVE-2019-12418,CVE-2019-17563 Sources used: openSUSE Leap 15.1 (src): tomcat-9.0.30-lp151.3.6.1
SUSE-SU-2020:0226-1: An update that solves three vulnerabilities and has one errata is now available. Category: security (important) Bug References: 1139924,1159723,1159729,1161025 CVE References: CVE-2019-10072,CVE-2019-12418,CVE-2019-17563 Sources used: SUSE Linux Enterprise Module for Web Scripting 15 (src): tomcat-9.0.30-3.34.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 (src): tomcat-9.0.30-3.34.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2020:0632-1: An update that fixes 6 vulnerabilities is now available. Category: security (important) Bug References: 1139924,1159723,1159729,1164692,1164825,1164860 CVE References: CVE-2019-10072,CVE-2019-12418,CVE-2019-17563,CVE-2019-17569,CVE-2020-1935,CVE-2020-1938 Sources used: SUSE Linux Enterprise Server 12-SP5 (src): tomcat-9.0.31-3.25.1 SUSE Linux Enterprise Server 12-SP4 (src): tomcat-9.0.31-3.25.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Done