Information disclosure in Apache Tomcat
CVE-2020-17527
While investigating bug 64830 it was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request header value from the previous stream received on an HTTP/2 connection for the request associated with the subsequent stream. While this would most likely lead to an error and the closure of the HTTP/2 connection, it is possible that information could leak between requests.
Vulnerability class: Information Disclosure
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.246 (97.9th percentile), scored .
Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 98th percentile — 97.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.246 · newest: 0.246 · change: 0.000
Affected products
- Apache Tomcat — versions 9.0.0, 9.0.35-3.39.1, 9.0.35-3.57.3
- Apache Software Foundation Tomcat — versions Apache Tomcat 10 10.0.0-M1 to 10.0.0-M9, Apache Tomcat 9 9.0.0-M1 to 9.0.39, Apache Tomcat 8.5 8.5.0 to 8.5.59
- NetApp Element Plug-In
- NetApp Oncommand System Manager
- Oracle Blockchain Platform
- Oracle Communications Cloud Native Core Binding Support Function — versions 1.10.0
- Oracle Communications Cloud Native Core Policy — versions 1.14.0
- Oracle Communications Instant Messaging Server — versions 10.0.1.5.0
- Oracle Instantis Enterprisetrack — versions 17.1, 17.2, 17.3
- Oracle MySQL Enterprise Monitor
Weakness classification (CWE)
Public proof-of-concept exploits
References
- lists.apache.org/thread.html/rce5ac9a40173651d540babce59f6f3825f12c6d4e886ba008… (Mailing List, Vendor Advisory)
- lists.apache.org/thread.html/r8a227ac6a755a6406c1cc47dd48800e973d4cf13fe7fe68ac… (mailing-list)
- lists.apache.org/thread.html/raa0e9ad388c1e6fd1e301b5e080f9439f64cb4178119a86a4… (mailing-list)
- lists.apache.org/thread.html/rce5ac9a40173651d540babce59f6f3825f12c6d4e886ba008… (mailing-list)
- lists.apache.org/thread.html/rd5babd13d7a350b369b2f647b4dd32ce678af42f9aba5389d… (mailing-list)
- www.openwall.com/lists/oss-security/2020/12/03/3 (mailing-list, Mailing List, Third Party Advisory)
- lists.apache.org/thread.html/rabbe6b3ae6a9795641d7a05c00d2378d5bbbe4240b7e20f09… (mailing-list)
- lists.apache.org/thread.html/ra35c8d617b17d59f400112cebadec43ad379f98198b4a9726… (mailing-list)
- lists.apache.org/thread.html/r9fd47f1b03e9b41d16a5cf72659b533887267d3398d963c2f… (mailing-list)
- lists.apache.org/thread.html/r26a2a66339087fc37db3caf201e446d3e83b5cce314371e23… (mailing-list)
Frequently asked questions
- What is CVE-2020-17527?
- CVE-2020-17527 is a high-severity vulnerability in Apache Tomcat, classified under Information Disclosure. CVSS score: 7.5/10. Published 2020-12-03.
- How severe is CVE-2020-17527?
- High severity. CVSS v3 base score is 7.5 out of 10.
- Is CVE-2020-17527 known to be exploited?
- 16 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.