CVE-2019-10072: High severity Apache Tomcat vulnerability
Apache Tomcat is vulnerable to a denial of service, caused by HTTP/2 connection window exhaustion on write. By failing to send WINDOWUPDATE messages, a remote attacker could exploit this vulnerability to block threads on the server and cause a denial of service.
Other sources
The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write in Apache Tomcat versions 9.0.0.M1 to 9.0.19 and 8.5.0 to 8.5.40 . By not sending WINDOWUPDATE messages for the connection window (stream 0) clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.
The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write. By not sending WINDOWUPDATE messages for the connection window (stream 0) clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.
References:
http://tomcat.apache.org/security-9.html#FixedinApacheTomcat9.0.20 http://tomcat.apache.org/security-8.html#FixedinApacheTomcat8.5.41 http://mail-archives.us.apache.org/modmbox/www-announce/201906.mbox/%3Cca69531a-1592-be7b-60ce-729549c7f812%40apache.org%3E
Upstream commits:
Tomcat 9.0: https://github.com/apache/tomcat/commit/7f748eb https://github.com/apache/tomcat/commit/ada725a
Tomcat 8.5 https://github.com/apache/tomcat/commit/0bcd69c https://github.com/apache/tomcat/commit/8d14c6f
— Red Hat
Affected Software
Remediation
Information
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2019-10072?
CVE-2019-10072 is a vulnerability in Apache Tomcat that allows clients to cause server-side threads to become exhausted.
What is the severity of CVE-2019-10072?
CVE-2019-10072 has a severity rating of 5.3 (Medium).
Which versions of Apache Tomcat are affected by CVE-2019-10072?
Apache Tomcat versions 9.0.0.M1 to 9.0.19 and 8.5.0 to 8.5.40 are affected by CVE-2019-10072.
How can I fix CVE-2019-10072?
Update your Apache Tomcat installation to version 9.0.20 or later (for 9.x) or version 8.5.41 or later (for 8.5.x).
Where can I find more information about CVE-2019-10072?
You can find more information about CVE-2019-10072 at the following references: - [CVE-2019-10072](https://www.cve.org/CVERecord?id=CVE-2019-10072) - [NVD](https://nvd.nist.gov/vuln/detail/CVE-2019-10072) - [Apache Tomcat Security](http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.41) - [Bugzilla](https://bugzilla.redhat.com/show_bug.cgi?id=1723708) - [Red Hat Security Advisory](https://access.redhat.com/errata/RHSA-2019:3931)