2023-04-24 12:24:31 +02:00
{
"id" : "CVE-2019-10072" ,
"sourceIdentifier" : "security@apache.org" ,
"published" : "2019-06-21T18:15:09.513" ,
2023-11-07 21:03:21 +00:00
"lastModified" : "2023-11-07T03:02:21.460" ,
2023-04-24 12:24:31 +02:00
"vulnStatus" : "Modified" ,
"descriptions" : [
{
"lang" : "en" ,
"value" : "The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write in Apache Tomcat versions 9.0.0.M1 to 9.0.19 and 8.5.0 to 8.5.40 . By not sending WINDOW_UPDATE messages for the connection window (stream 0) clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS."
} ,
{
"lang" : "es" ,
"value" : "La soluci\u00f3n para el CVE-2019-0199 estaba incompleta y no abordaba el agotamiento de la ventana de conexi\u00f3n HTTP/2 al escribir en de Apache Tomcat versiones desde 9.0.0.M1 hasta 9.0.19 y 8.5.0 hasta 8.5.40. Al no enviar mensajes de WINDOW_UPDATE para la ventana de conexi\u00f3n (stream 0), los clientes fueron habilitados para causar que los hilos (subprocesos) del lado del servidor se bloquearan eventualmente conllevando al agotamiento del hilo (subproceso) y a una DoS."
}
] ,
"metrics" : {
"cvssMetricV30" : [
{
"source" : "nvd@nist.gov" ,
"type" : "Primary" ,
"cvssData" : {
"version" : "3.0" ,
"vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" ,
"attackVector" : "NETWORK" ,
"attackComplexity" : "LOW" ,
"privilegesRequired" : "NONE" ,
"userInteraction" : "NONE" ,
"scope" : "UNCHANGED" ,
"confidentialityImpact" : "NONE" ,
"integrityImpact" : "NONE" ,
"availabilityImpact" : "HIGH" ,
"baseScore" : 7.5 ,
"baseSeverity" : "HIGH"
} ,
"exploitabilityScore" : 3.9 ,
"impactScore" : 3.6
}
] ,
"cvssMetricV2" : [
{
"source" : "nvd@nist.gov" ,
"type" : "Primary" ,
"cvssData" : {
"version" : "2.0" ,
"vectorString" : "AV:N/AC:L/Au:N/C:N/I:N/A:P" ,
"accessVector" : "NETWORK" ,
"accessComplexity" : "LOW" ,
"authentication" : "NONE" ,
"confidentialityImpact" : "NONE" ,
"integrityImpact" : "NONE" ,
"availabilityImpact" : "PARTIAL" ,
"baseScore" : 5.0
} ,
"baseSeverity" : "MEDIUM" ,
"exploitabilityScore" : 10.0 ,
"impactScore" : 2.9 ,
"acInsufInfo" : false ,
"obtainAllPrivilege" : false ,
"obtainUserPrivilege" : false ,
"obtainOtherPrivilege" : false ,
"userInteractionRequired" : false
}
]
} ,
"weaknesses" : [
{
"source" : "nvd@nist.gov" ,
"type" : "Primary" ,
"description" : [
{
"lang" : "en" ,
"value" : "CWE-667"
}
]
}
] ,
"configurations" : [
{
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*" ,
"versionStartIncluding" : "8.5.0" ,
"versionEndIncluding" : "8.5.40" ,
"matchCriteriaId" : "03908E64-26F3-48BE-82C6-39236F1303E7"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*" ,
"versionStartIncluding" : "9.0.1" ,
"versionEndIncluding" : "9.0.19" ,
"matchCriteriaId" : "63A4C97C-AF4E-41C7-8F98-ABF6E2EA61D8"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:apache:tomcat:9.0.0:m1:*:*:*:*:*:*" ,
"matchCriteriaId" : "34EB147F-4D0B-49D5-95DB-ED36F6ECA517"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:apache:tomcat:9.0.0:m10:*:*:*:*:*:*" ,
"matchCriteriaId" : "E6A52BDB-1384-470D-9A45-2A5A3F6A9795"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:apache:tomcat:9.0.0:m11:*:*:*:*:*:*" ,
"matchCriteriaId" : "50820930-F6F0-4BDC-90A5-CC54592A7970"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:apache:tomcat:9.0.0:m12:*:*:*:*:*:*" ,
"matchCriteriaId" : "3A401718-6009-4BAB-AE21-D8CDC11BA28A"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:apache:tomcat:9.0.0:m13:*:*:*:*:*:*" ,
"matchCriteriaId" : "87C93F0D-3C87-4E53-9426-4E442279A616"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:apache:tomcat:9.0.0:m14:*:*:*:*:*:*" ,
"matchCriteriaId" : "D386FA01-80C5-44FA-8B4D-9A4321575929"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:apache:tomcat:9.0.0:m15:*:*:*:*:*:*" ,
"matchCriteriaId" : "A7084406-5F98-407C-AB0C-8FB49090DB84"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:apache:tomcat:9.0.0:m16:*:*:*:*:*:*" ,
"matchCriteriaId" : "23D299BF-CF9D-47AC-BFE3-EB8FB6ED85A2"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:apache:tomcat:9.0.0:m17:*:*:*:*:*:*" ,
"matchCriteriaId" : "458707DD-0813-46A2-AF43-99E51001A252"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:apache:tomcat:9.0.0:m18:*:*:*:*:*:*" ,
"matchCriteriaId" : "FFD72BFB-A4BF-4AA3-A116-E03682FD6A3F"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:apache:tomcat:9.0.0:m19:*:*:*:*:*:*" ,
"matchCriteriaId" : "5607C05A-3A02-4ECD-9485-3106D94C6017"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:apache:tomcat:9.0.0:m2:*:*:*:*:*:*" ,
"matchCriteriaId" : "E99E2479-0701-45F8-A2E3-032FBECCE704"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:apache:tomcat:9.0.0:m20:*:*:*:*:*:*" ,
"matchCriteriaId" : "4FF53C5D-BE39-4A82-81A9-B754FBAE8974"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:apache:tomcat:9.0.0:m21:*:*:*:*:*:*" ,
"matchCriteriaId" : "6F1932C7-0D7C-4D0C-A0F7-BD4E78AAC9B1"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:apache:tomcat:9.0.0:m22:*:*:*:*:*:*" ,
"matchCriteriaId" : "A0E9EE78-020F-4EA3-BEC7-254571686559"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:apache:tomcat:9.0.0:m23:*:*:*:*:*:*" ,
"matchCriteriaId" : "5DF108E2-BBBA-41F4-B51F-E2DD56C4974E"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:apache:tomcat:9.0.0:m24:*:*:*:*:*:*" ,
"matchCriteriaId" : "CE6B8ED0-01E6-4382-B1D9-DD00121EB656"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:apache:tomcat:9.0.0:m25:*:*:*:*:*:*" ,
"matchCriteriaId" : "99D7925D-A541-4AD8-B558-ED29000A4249"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:apache:tomcat:9.0.0:m26:*:*:*:*:*:*" ,
"matchCriteriaId" : "65338975-C706-45E1-BE75-D59192D8A9F2"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:apache:tomcat:9.0.0:m27:*:*:*:*:*:*" ,
"matchCriteriaId" : "C4B76DFF-28CF-4FDC-9630-10EAE800525F"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:apache:tomcat:9.0.0:m3:*:*:*:*:*:*" ,
"matchCriteriaId" : "01633F5D-3C81-41B0-84B5-4EF5F58C50C5"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:apache:tomcat:9.0.0:m4:*:*:*:*:*:*" ,
"matchCriteriaId" : "0A9F84CF-504C-4265-8DB3-1F108B7C3BFE"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:apache:tomcat:9.0.0:m5:*:*:*:*:*:*" ,
"matchCriteriaId" : "A8A9EBAD-79A9-4774-B2AA-7A45B36B5E63"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:apache:tomcat:9.0.0:m6:*:*:*:*:*:*" ,
"matchCriteriaId" : "B4BD6F87-A60C-40DA-BDFB-8E7A7448F37E"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:apache:tomcat:9.0.0:m7:*:*:*:*:*:*" ,
"matchCriteriaId" : "4C828DCE-1C17-48B3-89F2-A461E00C9211"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:apache:tomcat:9.0.0:m8:*:*:*:*:*:*" ,
"matchCriteriaId" : "6930A67B-C0D8-4CB0-BCC8-5F8448C60651"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:apache:tomcat:9.0.0:m9:*:*:*:*:*:*" ,
"matchCriteriaId" : "C3D53D09-BDDC-4282-B7C7-34CC82476FDE"
}
]
}
]
}
] ,
"references" : [
{
"url" : "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00013.html" ,
"source" : "security@apache.org"
} ,
{
"url" : "http://www.securityfocus.com/bid/108874" ,
"source" : "security@apache.org"
} ,
{
"url" : "https://access.redhat.com/errata/RHSA-2019:3929" ,
"source" : "security@apache.org"
} ,
{
"url" : "https://access.redhat.com/errata/RHSA-2019:3931" ,
"source" : "security@apache.org"
} ,
{
2023-11-07 21:03:21 +00:00
"url" : "https://lists.apache.org/thread.html/df1a2c1b87c8a6c500ecdbbaf134c7f1491c8d79d98b48c6b9f0fa6a%40%3Cannounce.tomcat.apache.org%3E" ,
"source" : "security@apache.org"
2023-04-24 12:24:31 +02:00
} ,
{
2023-11-07 21:03:21 +00:00
"url" : "https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E" ,
2023-04-24 12:24:31 +02:00
"source" : "security@apache.org"
} ,
{
2023-11-07 21:03:21 +00:00
"url" : "https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E" ,
2023-04-24 12:24:31 +02:00
"source" : "security@apache.org"
} ,
{
2023-11-07 21:03:21 +00:00
"url" : "https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E" ,
2023-04-24 12:24:31 +02:00
"source" : "security@apache.org"
} ,
{
2023-11-07 21:03:21 +00:00
"url" : "https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E" ,
2023-04-24 12:24:31 +02:00
"source" : "security@apache.org"
} ,
{
"url" : "https://security.netapp.com/advisory/ntap-20190625-0002/" ,
"source" : "security@apache.org"
} ,
{
"url" : "https://support.f5.com/csp/article/K17321505" ,
"source" : "security@apache.org"
} ,
{
"url" : "https://usn.ubuntu.com/4128-1/" ,
"source" : "security@apache.org"
} ,
{
"url" : "https://usn.ubuntu.com/4128-2/" ,
"source" : "security@apache.org"
} ,
{
"url" : "https://www.debian.org/security/2020/dsa-4680" ,
"source" : "security@apache.org"
} ,
{
"url" : "https://www.oracle.com/security-alerts/cpuApr2021.html" ,
"source" : "security@apache.org"
} ,
{
"url" : "https://www.oracle.com/security-alerts/cpuapr2020.html" ,
"source" : "security@apache.org"
} ,
{
"url" : "https://www.oracle.com/security-alerts/cpujan2020.html" ,
"source" : "security@apache.org"
} ,
{
"url" : "https://www.oracle.com/security-alerts/cpuoct2020.html" ,
"source" : "security@apache.org"
} ,
{
"url" : "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html" ,
"source" : "security@apache.org"
} ,
{
"url" : "https://www.synology.com/security/advisory/Synology_SA_19_29" ,
"source" : "security@apache.org"
}
]
}
