Strix
26.1K

CVE-2020-17527

HIGHCVSS 7.5/10EPSS 24.62%

Last modified

CVE-2020-17527 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. While investigating bug 64830 it was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request header value from the previous stream received on an HTTP/2 connection for the request associated with the subsequent stream. While this would most likely lead to an error and the closure of the HTTP/2 connection, it is possible that information could leak between requests.. EPSS estimates a 24.62% chance of exploitation in the next 30 days.

Description

While investigating bug 64830 it was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request header value from the previous stream received on an HTTP/2 connection for the request associated with the subsequent stream. While this would most likely lead to an error and the closure of the HTTP/2 connection, it is possible that information could leak between requests.

Metrics

CVSS 3.1
7.5/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS Probability
24.62%

97.6th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersionsUpdate
ApacheTomcat>= 8.5.1, <= 8.5.59—
ApacheTomcat>= 9.0.1, <= 9.0.35—
ApacheTomcat9.0.0Milestone10
ApacheTomcat9.0.35-3.39.1—
ApacheTomcat9.0.35-3.57.3—
ApacheTomcat9.0.36—
ApacheTomcat9.0.37—
ApacheTomcat9.0.38—
ApacheTomcat9.0.39—
ApacheTomcat10.0.0Milestone1
NetappElement Plug-InAll versions—
NetappOncommand System Manager>= 3.0.0, <= 3.1.3—
DebianDebian Linux9.0—
DebianDebian Linux10.0—
OracleBlockchain Platform< 21.1.2—
OracleCommunications Cloud Native Core Binding Support Function1.10.0—
OracleCommunications Cloud Native Core Policy1.14.0—
OracleCommunications Instant Messaging Server10.0.1.5.0—
OracleInstantis Enterprisetrack17.1—
OracleInstantis Enterprisetrack17.2—
OracleInstantis Enterprisetrack17.3—
OracleMysql Enterprise Monitor< 8.0.23—
OracleSd-Wan Edge9.0—
OracleWorkload Manager18c—
OracleWorkload Manager19c—

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2020-17527?
While investigating bug 64830 it was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request header value from the previous stream received on an HTTP/2 connection for the request associated with the subsequent stream. While this would most likely lead to an error and the closure of the HTTP/2 connection, it is possible that information could leak between requests.
How severe is CVE-2020-17527?
CVE-2020-17527 has a CVSS score of 7.5/10 (HIGH severity). The EPSS model estimates a 24.62% probability of exploitation in the next 30 days.
How do I fix CVE-2020-17527?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2020-17527?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST