You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
In Apache Tomcat 9.0.0.M1 to 9.0.0.M18 and 8.5.0 to 8.5.12, the handling of an HTTP/2 GOAWAY frame for a connection did not close streams associated with that connection that were currently waiting for a WINDOW_UPDATE before allowing the application to write more data. These waiting streams each consumed a thread. A malicious client could therefore construct a series of HTTP/2 requests that would consume all available processing threads.
CVE-2017-5650 - High Severity Vulnerability
Core Tomcat implementation
Library home page: http://tomcat.apache.org/
Path to dependency file: /demo-app-master/pom.xml
Path to vulnerable library: /root/.m2/repository/org/apache/tomcat/embed/tomcat-embed-core/8.5.4/tomcat-embed-core-8.5.4.jar
Dependency Hierarchy:
Found in HEAD commit: 36bced415c2afa8e05045e2eb1e9c10507f085a4
In Apache Tomcat 9.0.0.M1 to 9.0.0.M18 and 8.5.0 to 8.5.12, the handling of an HTTP/2 GOAWAY frame for a connection did not close streams associated with that connection that were currently waiting for a WINDOW_UPDATE before allowing the application to write more data. These waiting streams each consumed a thread. A malicious client could therefore construct a series of HTTP/2 requests that would consume all available processing threads.
Publish Date: 2017-04-17
URL: CVE-2017-5650
Base Score Metrics:
Type: Upgrade version
Origin: http://www.securitytracker.com/id/1038217
Fix Resolution: The vendor has issued a fix (8.5.13, 9.0.0.M19).
The vendor advisory is available at:
http://tomcat.apache.org/security-8.html
http://tomcat.apache.org/security-9.html
Step up your Open Source Security Game with WhiteSource here
The text was updated successfully, but these errors were encountered: