CVE-2020-17527: Apache Tomcat: Request header mix-up between HTTP/2 streams
Apache Tomcat could allow a remote attacker to obtain sensitive information, caused by an issue when the HTTP request header value can be reused from the previous stream received on an HTTP/2 connection. By sending a specially-crafted HTTP request, an attacker could exploit this vulnerability to obtain sensitive information, and use this information to launch further attacks against the affected system.
Other sources
Apache Tomcat: Request header mix-up between HTTP/2 streams
— Microsoft
While investigating bug 64830 it was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request header value from the previous stream received on an HTTP/2 connection for the request associated with the subsequent stream. While this would most likely lead to an error and the closure of the HTTP/2 connection, it is possible that information could leak between requests.
While investigating Bug 64830 it was discovered that Apache Tomcat could re-use an HTTP request header value from the previous stream received on an HTTP/2 connection for the request associated with the subsequent stream. While this would most likely lead to an error and the closure of the HTTP/2 connection, it is possible that information could leak between requests.
Reference: https://lists.apache.org/thread.html/rce5ac9a40173651d540babce59f6f3825f12c6d4e886ba00823b11e5@%3Cannounce.apache.org%3E
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2020-17527?
The severity of CVE-2020-17527 is high.
How does CVE-2020-17527 affect Apache Tomcat?
CVE-2020-17527 affects Apache Tomcat versions 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39, and 8.5.0 to 8.5.59.
How can I fix CVE-2020-17527 in Apache Tomcat?
To fix CVE-2020-17527 in Apache Tomcat, update to version 10.0.0-M10, 9.0.40, or 8.5.60.
Are there any references for CVE-2020-17527?
Yes, you can find references for CVE-2020-17527 at the following links: [reference 1](https://www.cve.org/CVERecord?id=CVE-2020-17527), [reference 2](https://nvd.nist.gov/vuln/detail/CVE-2020-17527), [reference 3](http://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.0.0-M10), [reference 4](http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.60), [reference 5](http://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.40), [reference 6](https://bugzilla.redhat.com/show_bug.cgi?id=1904221), [reference 7](https://access.redhat.com/errata/RHSA-2021:5134).
What is the Common Weakness Enumeration (CWE) ID for CVE-2020-17527?
The Common Weakness Enumeration (CWE) ID for CVE-2020-17527 is 200.