mirror of
https://github.com/fkie-cad/nvd-json-data-feeds.git
synced 2025-05-28 01:02:25 +00:00
325 lines
12 KiB
JSON
325 lines
12 KiB
JSON
{
|
|
"id": "CVE-2019-10072",
|
|
"sourceIdentifier": "security@apache.org",
|
|
"published": "2019-06-21T18:15:09.513",
|
|
"lastModified": "2021-06-14T18:15:14.460",
|
|
"vulnStatus": "Modified",
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write in Apache Tomcat versions 9.0.0.M1 to 9.0.19 and 8.5.0 to 8.5.40 . By not sending WINDOW_UPDATE messages for the connection window (stream 0) clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS."
|
|
},
|
|
{
|
|
"lang": "es",
|
|
"value": "La soluci\u00f3n para el CVE-2019-0199 estaba incompleta y no abordaba el agotamiento de la ventana de conexi\u00f3n HTTP/2 al escribir en de Apache Tomcat versiones desde 9.0.0.M1 hasta 9.0.19 y 8.5.0 hasta 8.5.40. Al no enviar mensajes de WINDOW_UPDATE para la ventana de conexi\u00f3n (stream 0), los clientes fueron habilitados para causar que los hilos (subprocesos) del lado del servidor se bloquearan eventualmente conllevando al agotamiento del hilo (subproceso) y a una DoS."
|
|
}
|
|
],
|
|
"metrics": {
|
|
"cvssMetricV30": [
|
|
{
|
|
"source": "nvd@nist.gov",
|
|
"type": "Primary",
|
|
"cvssData": {
|
|
"version": "3.0",
|
|
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
|
|
"attackVector": "NETWORK",
|
|
"attackComplexity": "LOW",
|
|
"privilegesRequired": "NONE",
|
|
"userInteraction": "NONE",
|
|
"scope": "UNCHANGED",
|
|
"confidentialityImpact": "NONE",
|
|
"integrityImpact": "NONE",
|
|
"availabilityImpact": "HIGH",
|
|
"baseScore": 7.5,
|
|
"baseSeverity": "HIGH"
|
|
},
|
|
"exploitabilityScore": 3.9,
|
|
"impactScore": 3.6
|
|
}
|
|
],
|
|
"cvssMetricV2": [
|
|
{
|
|
"source": "nvd@nist.gov",
|
|
"type": "Primary",
|
|
"cvssData": {
|
|
"version": "2.0",
|
|
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
|
|
"accessVector": "NETWORK",
|
|
"accessComplexity": "LOW",
|
|
"authentication": "NONE",
|
|
"confidentialityImpact": "NONE",
|
|
"integrityImpact": "NONE",
|
|
"availabilityImpact": "PARTIAL",
|
|
"baseScore": 5.0
|
|
},
|
|
"baseSeverity": "MEDIUM",
|
|
"exploitabilityScore": 10.0,
|
|
"impactScore": 2.9,
|
|
"acInsufInfo": false,
|
|
"obtainAllPrivilege": false,
|
|
"obtainUserPrivilege": false,
|
|
"obtainOtherPrivilege": false,
|
|
"userInteractionRequired": false
|
|
}
|
|
]
|
|
},
|
|
"weaknesses": [
|
|
{
|
|
"source": "nvd@nist.gov",
|
|
"type": "Primary",
|
|
"description": [
|
|
{
|
|
"lang": "en",
|
|
"value": "CWE-667"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"configurations": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "8.5.0",
|
|
"versionEndIncluding": "8.5.40",
|
|
"matchCriteriaId": "03908E64-26F3-48BE-82C6-39236F1303E7"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "9.0.1",
|
|
"versionEndIncluding": "9.0.19",
|
|
"matchCriteriaId": "63A4C97C-AF4E-41C7-8F98-ABF6E2EA61D8"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:m1:*:*:*:*:*:*",
|
|
"matchCriteriaId": "34EB147F-4D0B-49D5-95DB-ED36F6ECA517"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:m10:*:*:*:*:*:*",
|
|
"matchCriteriaId": "E6A52BDB-1384-470D-9A45-2A5A3F6A9795"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:m11:*:*:*:*:*:*",
|
|
"matchCriteriaId": "50820930-F6F0-4BDC-90A5-CC54592A7970"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:m12:*:*:*:*:*:*",
|
|
"matchCriteriaId": "3A401718-6009-4BAB-AE21-D8CDC11BA28A"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:m13:*:*:*:*:*:*",
|
|
"matchCriteriaId": "87C93F0D-3C87-4E53-9426-4E442279A616"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:m14:*:*:*:*:*:*",
|
|
"matchCriteriaId": "D386FA01-80C5-44FA-8B4D-9A4321575929"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:m15:*:*:*:*:*:*",
|
|
"matchCriteriaId": "A7084406-5F98-407C-AB0C-8FB49090DB84"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:m16:*:*:*:*:*:*",
|
|
"matchCriteriaId": "23D299BF-CF9D-47AC-BFE3-EB8FB6ED85A2"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:m17:*:*:*:*:*:*",
|
|
"matchCriteriaId": "458707DD-0813-46A2-AF43-99E51001A252"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:m18:*:*:*:*:*:*",
|
|
"matchCriteriaId": "FFD72BFB-A4BF-4AA3-A116-E03682FD6A3F"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:m19:*:*:*:*:*:*",
|
|
"matchCriteriaId": "5607C05A-3A02-4ECD-9485-3106D94C6017"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:m2:*:*:*:*:*:*",
|
|
"matchCriteriaId": "E99E2479-0701-45F8-A2E3-032FBECCE704"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:m20:*:*:*:*:*:*",
|
|
"matchCriteriaId": "4FF53C5D-BE39-4A82-81A9-B754FBAE8974"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:m21:*:*:*:*:*:*",
|
|
"matchCriteriaId": "6F1932C7-0D7C-4D0C-A0F7-BD4E78AAC9B1"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:m22:*:*:*:*:*:*",
|
|
"matchCriteriaId": "A0E9EE78-020F-4EA3-BEC7-254571686559"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:m23:*:*:*:*:*:*",
|
|
"matchCriteriaId": "5DF108E2-BBBA-41F4-B51F-E2DD56C4974E"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:m24:*:*:*:*:*:*",
|
|
"matchCriteriaId": "CE6B8ED0-01E6-4382-B1D9-DD00121EB656"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:m25:*:*:*:*:*:*",
|
|
"matchCriteriaId": "99D7925D-A541-4AD8-B558-ED29000A4249"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:m26:*:*:*:*:*:*",
|
|
"matchCriteriaId": "65338975-C706-45E1-BE75-D59192D8A9F2"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:m27:*:*:*:*:*:*",
|
|
"matchCriteriaId": "C4B76DFF-28CF-4FDC-9630-10EAE800525F"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:m3:*:*:*:*:*:*",
|
|
"matchCriteriaId": "01633F5D-3C81-41B0-84B5-4EF5F58C50C5"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:m4:*:*:*:*:*:*",
|
|
"matchCriteriaId": "0A9F84CF-504C-4265-8DB3-1F108B7C3BFE"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:m5:*:*:*:*:*:*",
|
|
"matchCriteriaId": "A8A9EBAD-79A9-4774-B2AA-7A45B36B5E63"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:m6:*:*:*:*:*:*",
|
|
"matchCriteriaId": "B4BD6F87-A60C-40DA-BDFB-8E7A7448F37E"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:m7:*:*:*:*:*:*",
|
|
"matchCriteriaId": "4C828DCE-1C17-48B3-89F2-A461E00C9211"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:m8:*:*:*:*:*:*",
|
|
"matchCriteriaId": "6930A67B-C0D8-4CB0-BCC8-5F8448C60651"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:m9:*:*:*:*:*:*",
|
|
"matchCriteriaId": "C3D53D09-BDDC-4282-B7C7-34CC82476FDE"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00013.html",
|
|
"source": "security@apache.org"
|
|
},
|
|
{
|
|
"url": "http://www.securityfocus.com/bid/108874",
|
|
"source": "security@apache.org"
|
|
},
|
|
{
|
|
"url": "https://access.redhat.com/errata/RHSA-2019:3929",
|
|
"source": "security@apache.org"
|
|
},
|
|
{
|
|
"url": "https://access.redhat.com/errata/RHSA-2019:3931",
|
|
"source": "security@apache.org"
|
|
},
|
|
{
|
|
"url": "https://lists.apache.org/thread.html/df1a2c1b87c8a6c500ecdbbaf134c7f1491c8d79d98b48c6b9f0fa6a@%3Cannounce.tomcat.apache.org%3E",
|
|
"source": "security@apache.org",
|
|
"tags": [
|
|
"Mailing List",
|
|
"Vendor Advisory"
|
|
]
|
|
},
|
|
{
|
|
"url": "https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d@%3Cdev.tomcat.apache.org%3E",
|
|
"source": "security@apache.org"
|
|
},
|
|
{
|
|
"url": "https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0@%3Cdev.tomcat.apache.org%3E",
|
|
"source": "security@apache.org"
|
|
},
|
|
{
|
|
"url": "https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9@%3Cdev.tomcat.apache.org%3E",
|
|
"source": "security@apache.org"
|
|
},
|
|
{
|
|
"url": "https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a@%3Cdev.tomcat.apache.org%3E",
|
|
"source": "security@apache.org"
|
|
},
|
|
{
|
|
"url": "https://security.netapp.com/advisory/ntap-20190625-0002/",
|
|
"source": "security@apache.org"
|
|
},
|
|
{
|
|
"url": "https://support.f5.com/csp/article/K17321505",
|
|
"source": "security@apache.org"
|
|
},
|
|
{
|
|
"url": "https://usn.ubuntu.com/4128-1/",
|
|
"source": "security@apache.org"
|
|
},
|
|
{
|
|
"url": "https://usn.ubuntu.com/4128-2/",
|
|
"source": "security@apache.org"
|
|
},
|
|
{
|
|
"url": "https://www.debian.org/security/2020/dsa-4680",
|
|
"source": "security@apache.org"
|
|
},
|
|
{
|
|
"url": "https://www.oracle.com/security-alerts/cpuApr2021.html",
|
|
"source": "security@apache.org"
|
|
},
|
|
{
|
|
"url": "https://www.oracle.com/security-alerts/cpuapr2020.html",
|
|
"source": "security@apache.org"
|
|
},
|
|
{
|
|
"url": "https://www.oracle.com/security-alerts/cpujan2020.html",
|
|
"source": "security@apache.org"
|
|
},
|
|
{
|
|
"url": "https://www.oracle.com/security-alerts/cpuoct2020.html",
|
|
"source": "security@apache.org"
|
|
},
|
|
{
|
|
"url": "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html",
|
|
"source": "security@apache.org"
|
|
},
|
|
{
|
|
"url": "https://www.synology.com/security/advisory/Synology_SA_19_29",
|
|
"source": "security@apache.org"
|
|
}
|
|
]
|
|
} |