A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU usage for several seconds. If a sufficient number of such requests were made on concurrent HTTP/2 connections, the server could become unresponsive.

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - tomcat: Session fixation when using FORM authentication (CVE-2019-17563)

  - tomcat: JsonErrorReportValve injection (CVE-2022-45143)

  - The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes     user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by default. The     printenv command is intended for debugging and is unlikely to be present in a production website.
    (CVE-2019-0221)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The version of IBM Engineering Requirements Management DOORS (formerly IBM Rational DOORS) installed on the remote host is 9.7.2.x prior to 9.7.2.8. It is, therefore, affected by multiple vulnerabilities as referenced in the 7124058 advisory.

  - Apache Shiro before 1.9.1, A RegexRequestMatcher can be misconfigured to be bypassed on some servlet     containers. Applications using RegExPatternMatcher with `.` in the regular expression are possibly     vulnerable to an authorization bypass. (CVE-2022-32532)

  - The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow     a remote attacker with network access to either a Java-based OpenWire broker or client to run arbitrary     shell commands by manipulating serialized class types in the OpenWire protocol to cause either the client     or the broker (respectively) to instantiate any class on the classpath. Users are recommended to upgrade     both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3 which fixes this issue.
    (CVE-2023-46604)

  - Scala 2.13.x before 2.13.9 has a Java deserialization chain in its JAR file. On its own, it cannot be     exploited. There is only a risk in conjunction with Java object deserialization within an application. In     such situations, it allows attackers to erase contents of arbitrary files, make network connections, or     possibly run arbitrary code (specifically, Function0 functions) via a gadget chain. (CVE-2022-36944)

  - IBM Engineering Requirements Management DOORS 9.7.2.7 is vulnerable to cross-site request forgery which     could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the     website trusts. IBM X-Force ID: 251216. (CVE-2023-28949)

  - A cross-site scripting (XSS) vulnerability in the HTML Data Processor for CKEditor 4.0 before 4.14 allows     remote attackers to inject arbitrary web script through a crafted protected comment (with the     cke_protected syntax). (CVE-2020-9281)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 5.18. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-5.18 advisory.

  - When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to     Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP     connection. If such connections are available to an attacker, they can be exploited in ways that may be     surprising. In Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99, Tomcat shipped     with an AJP Connector enabled by default that listened on all configured IP addresses. It was expected     (and recommended in the security guide) that this Connector would be disabled if not required. This     vulnerability report identified a mechanism that allowed: - returning arbitrary files from anywhere in the     web application - processing any file in the web application as a JSP Further, if the web application     allowed file upload and stored those files within the web application (or the attacker was able to control     the content of the web application by some other means) then this, along with the ability to process a     file as a JSP, made remote code execution possible. It is important to note that mitigation is only     required if an AJP port is accessible to untrusted users. Users wishing to take a defence-in-depth     approach and block the vector that permits returning arbitrary files and execution as JSP may upgrade to     Apache Tomcat 9.0.31, 8.5.51 or 7.0.100 or later. A number of changes were made to the default AJP     Connector configuration in 9.0.31 to harden the default configuration. It is likely that users upgrading     to 9.0.31, 8.5.51 or 7.0.100 or later will need to make small changes to their configurations.
    (CVE-2020-1938)

  - rtl_p2p_noa_ie in drivers/net/wireless/realtek/rtlwifi/ps.c in the Linux kernel through 5.3.6 lacks a     certain upper-bound check, leading to a buffer overflow. (CVE-2019-17666)

  - The Linux kernel before 5.1-rc5 allows page->_refcount reference count overflow, with resultant use-after-     free issues, if about 140 GiB of RAM exists. This is related to fs/fuse/dev.c, fs/pipe.c, fs/splice.c,     include/linux/mm.h, include/linux/pipe_fs_i.h, kernel/trace/trace.c, mm/gup.c, and mm/hugetlb.c. It can     occur with FUSE requests. (CVE-2019-11487)

  - A flaw was found in the fix for CVE-2019-11135, in the Linux upstream kernel versions before 5.5 where,     the way Intel CPUs handle speculative execution of instructions when a TSX Asynchronous Abort (TAA) error     occurs. When a guest is running on a host CPU affected by the TAA flaw (TAA_NO=0), but is not affected by     the MDS issue (MDS_NO=1), the guest was to clear the affected buffers by using a VERW instruction     mechanism. But when the MDS_NO=1 bit was exported to the guests, the guests did not use the VERW mechanism     to clear the affected buffers. This issue affects guests running on Cascade Lake CPUs and requires that     host has 'TSX' enabled. Confidentiality of data is the highest threat associated with this vulnerability.
    (CVE-2019-19338)

  - The xz_decomp function in xzlib.c in libxml2 2.9.1 does not properly detect compression errors, which     allows context-dependent attackers to cause a denial of service (process hang) via crafted XML data.
    (CVE-2015-8035)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 5.16.1.3. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-5.16.1.3 advisory.

  - The Linux kernel before 5.1-rc5 allows page->_refcount reference count overflow, with resultant use-after-     free issues, if about 140 GiB of RAM exists. This is related to fs/fuse/dev.c, fs/pipe.c, fs/splice.c,     include/linux/mm.h, include/linux/pipe_fs_i.h, kernel/trace/trace.c, mm/gup.c, and mm/hugetlb.c. It can     occur with FUSE requests. (CVE-2019-11487)

  - rtl_p2p_noa_ie in drivers/net/wireless/realtek/rtlwifi/ps.c in the Linux kernel through 5.3.6 lacks a     certain upper-bound check, leading to a buffer overflow. (CVE-2019-17666)

  - A flaw was found in the fix for CVE-2019-11135, in the Linux upstream kernel versions before 5.5 where,     the way Intel CPUs handle speculative execution of instructions when a TSX Asynchronous Abort (TAA) error     occurs. When a guest is running on a host CPU affected by the TAA flaw (TAA_NO=0), but is not affected by     the MDS issue (MDS_NO=1), the guest was to clear the affected buffers by using a VERW instruction     mechanism. But when the MDS_NO=1 bit was exported to the guests, the guests did not use the VERW mechanism     to clear the affected buffers. This issue affects guests running on Cascade Lake CPUs and requires that     host has 'TSX' enabled. Confidentiality of data is the highest threat associated with this vulnerability.
    (CVE-2019-19338)

  - The Requests package before 2.20.0 for Python sends an HTTP Authorization header to an http URI upon     receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to discover     credentials by sniffing the network. (CVE-2018-18074)

  - urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin     redirect (i.e., a redirect that differs in host, port, or scheme). This can allow for credentials in the     Authorization header to be exposed to unintended hosts or transmitted in cleartext. (CVE-2018-20060)

  - In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the     request parameter. (CVE-2019-11236)

  - The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA     certificates is different from the OS store of CA certificates, which results in SSL connections     succeeding in situations where a verification failure is the correct outcome. This is related to use of     the ssl_context, ca_certs, or ca_certs_dir argument. (CVE-2019-11324)

  - The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with     excessive numbers of SETTINGS frames and also permitted clients to keep streams open without     reading/writing request/response data. By keeping streams open for requests that utilised the Servlet     API's blocking I/O, clients were able to cause server-side threads to block eventually leading to thread     exhaustion and a DoS. (CVE-2019-0199)

  - The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write     in Apache Tomcat versions 9.0.0.M1 to 9.0.19 and 8.5.0 to 8.5.40 . By not sending WINDOW_UPDATE messages     for the connection window (stream 0) clients were able to cause server-side threads to block eventually     leading to thread exhaustion and a DoS. (CVE-2019-10072)

  - When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote     Lifecycle Listener, a local attacker without access to the Tomcat process or configuration files is able     to manipulate the RMI registry to perform a man-in-the-middle attack to capture user names and passwords     used to access the JMX interface. The attacker can then use these credentials to access the JMX interface     and gain complete control over the Tomcat instance. (CVE-2019-12418)

  - When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98     there was a narrow window where an attacker could perform a session fixation attack. The window was     considered too narrow for an exploit to be practical but, erring on the side of caution, this issue has     been treated as a security vulnerability. (CVE-2019-17563)

  - The refactoring present in Apache Tomcat 9.0.28 to 9.0.30, 8.5.48 to 8.5.50 and 7.0.98 to 7.0.99     introduced a regression. The result of the regression was that invalid Transfer-Encoding headers were     incorrectly processed leading to a possibility of HTTP Request Smuggling if Tomcat was located behind a     reverse proxy that incorrectly handled the invalid Transfer-Encoding header in a particular manner. Such a     reverse proxy is considered unlikely. (CVE-2019-17569)

  - A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to     9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU usage for several seconds. If a sufficient number of     such requests were made on concurrent HTTP/2 connections, the server could become unresponsive.
    (CVE-2020-11996)

  - An h2c direct connection to Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36 and 8.5.1 to 8.5.56     did not release the HTTP/1.1 processor after the upgrade to HTTP/2. If a sufficient number of such     requests were made, an OutOfMemoryException could occur leading to a denial of service. (CVE-2020-13934)

  - The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to     10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid payload lengths could     trigger an infinite loop. Multiple requests with invalid payload lengths could lead to a denial of     service. (CVE-2020-13935)

  - In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used     an approach to end-of-line parsing that allowed some invalid HTTP headers to be parsed as valid. This led     to a possibility of HTTP Request Smuggling if Tomcat was located behind a reverse proxy that incorrectly     handled the invalid Transfer-Encoding header in a particular manner. Such a reverse proxy is considered     unlikely. (CVE-2020-1935)

  - When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to     Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP     connection. If such connections are available to an attacker, they can be exploited in ways that may be     surprising. In Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99, Tomcat shipped     with an AJP Connector enabled by default that listened on all configured IP addresses. It was expected     (and recommended in the security guide) that this Connector would be disabled if not required. This     vulnerability report identified a mechanism that allowed: - returning arbitrary files from anywhere in the     web application - processing any file in the web application as a JSP Further, if the web application     allowed file upload and stored those files within the web application (or the attacker was able to control     the content of the web application by some other means) then this, along with the ability to process a     file as a JSP, made remote code execution possible. It is important to note that mitigation is only     required if an AJP port is accessible to untrusted users. Users wishing to take a defence-in-depth     approach and block the vector that permits returning arbitrary files and execution as JSP may upgrade to     Apache Tomcat 9.0.31, 8.5.51 or 7.0.100 or later. A number of changes were made to the default AJP     Connector configuration in 9.0.31 to harden the default configuration. It is likely that users upgrading     to 9.0.31, 8.5.51 or 7.0.100 or later will need to make small changes to their configurations.
    (CVE-2020-1938)

  - When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to     7.0.103 if a) an attacker is able to control the contents and name of a file on the server; and b) the     server is configured to use the PersistenceManager with a FileStore; and c) the PersistenceManager is     configured with sessionAttributeValueClassNameFilter=null (the default unless a SecurityManager is used)     or a sufficiently lax filter to allow the attacker provided object to be deserialized; and d) the attacker     knows the relative file path from the storage location used by FileStore to the file the attacker has     control over; then, using a specifically crafted request, the attacker will be able to trigger remote code     execution via deserialization of the file under their control. Note that all of conditions a) to d) must     be true for the attack to succeed. (CVE-2020-9484)

  - An issue was discovered in International Components for Unicode (ICU) for C/C++ through 66.1. An integer     overflow, leading to a heap-based buffer overflow, exists in the UnicodeString::doAppend() function in     common/unistr.cpp. (CVE-2020-10531)

  - TSX Asynchronous Abort condition on some CPUs utilizing speculative execution may allow an authenticated     user to potentially enable information disclosure via a side channel with local access. (CVE-2019-11135)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tomcat installed on the remote host is prior to 10.0.0.M6. It is, therefore, affected by a vulnerability as referenced in the fixed_in_apache_tomcat_10.0.0-m6_security-10 advisory.

  - A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to     9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU usage for several seconds. If a sufficient number of     such requests were made on concurrent HTTP/2 connections, the server could become unresponsive.
    (CVE-2020-11996)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Apache Tomcat installed on the remote host is < 10.0.0-M6. It is, therefore, affected by a vulnerability as referenced in the fixed_in_apache_tomcat_10.0.0-m6_security-10 advisory. Note that Nessus Network Monitor has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the version of JFrog Artifactory installed on the remote host is prior to 7.7.0. It is, therefore, affected by multiple vulnerabilities:

  - An h2c direct connection to Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36 and 8.5.1 to 8.5.56 did not     release the HTTP/1.1 processor after the upgrade to HTTP/2. If a sufficient number of such requests were made,     an OutOfMemoryException could occur leading to a denial of service. (CVE-2020-13934)

  - The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6,     9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid payload lengths could trigger an infinite loop.
    Multiple requests with invalid payload lengths could lead to a denial of service. (CVE-2020-13935)

  - A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35     and 8.5.0 to 8.5.55 could trigger high CPU usage for several seconds. If a sufficient number of such requests were     made on concurrent HTTP/2 connections, the server could become unresponsive. (CVE-2020-11996)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 / 7 / 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:5170 advisory.

    Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web     applications. It is comprised of the Apache Tomcat Servlet container, JBoss HTTP Connector (mod_cluster),     the PicketLink Vault extension for Apache Tomcat, and the Tomcat Native library.

    This release of Red Hat JBoss Web Server 5.4 serves as a replacement for Red Hat JBoss Web Server 5.3, and     includes bug fixes, enhancements, and component upgrades, which are documented in the Release Notes,     linked to in the References.

    Security Fix(es):

    * tomcat: specially crafted sequence of HTTP/2 requests can lead to DoS (CVE-2020-11996)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4596-1 advisory.

    It was discovered that Tomcat did not properly manage HTTP/2 streams. An

    attacker could possibly use this to cause Tomcat to consume resources,

    resulting in a denial of service. (CVE-2020-11996)

    It was discovered that Tomcat did not properly release the HTTP/1.1

    processor after the upgrade to HTTP/2. An attacker could possibly use this to generate an     OutOfMemoryException, resulting in a denial of service.

    (CVE-2020-13934)

    It was discovered that Tomcat did not properly validate the payload length in a WebSocket frame. An     attacker could possibly use this to trigger an infinite loop, resulting in a denial of service.
    (CVE-2020-13935)

    It was discovered that Tomcat did not properly deserialize untrusted data. An attacker could possibly use     this issue to execute arbitrary code. (CVE-2020-9484)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Apache Tomcat installed on the remote host is 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 or 8.5.0 to 8.5.55. It is, therefore, affected by a denial of service via HTTP/2 requests.

Note that the scanner has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.

According to the versions of the tomcat packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The payload length in a WebSocket frame was not     correctly validated in Apache Tomcat 10.0.0-M1 to     10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and     7.0.27 to 7.0.104. Invalid payload lengths could     trigger an infinite loop. Multiple requests with     invalid payload lengths could lead to a denial of     service.(CVE-2020-13935)

  - An h2c direct connection to Apache Tomcat 10.0.0-M1 to     10.0.0-M6, 9.0.0.M5 to 9.0.36 and 8.5.1 to 8.5.56 did     not release the HTTP/1.1 processor after the upgrade to     HTTP/2. If a sufficient number of such requests were     made, an OutOfMemoryException could occur leading to a     denial of service.(CVE-2020-13934)

  - A specially crafted sequence of HTTP/2 requests sent to     Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to     9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU usage     for several seconds. If a sufficient number of such     requests were made on concurrent HTTP/2 connections,     the server could become unresponsive.(CVE-2020-11996)

  - When using Apache Tomcat versions 10.0.0-M1 to     10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and     7.0.0 to 7.0.103 if a) an attacker is able to control     the contents and name of a file on the server and b)     the server is configured to use the PersistenceManager     with a FileStore and c) the PersistenceManager is     configured with     sessionAttributeValueClassNameFilter='null' (the     default unless a SecurityManager is used) or a     sufficiently lax filter to allow the attacker provided     object to be deserialized and d) the attacker knows the     relative file path from the storage location used by     FileStore to the file the attacker has control over     then, using a specifically crafted request, the     attacker will be able to trigger remote code execution     via deserialization of the file under their control.
    Note that all of conditions a) to d) must be true for     the attack to succeed.(CVE-2020-9484)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for tomcat fixes the following issues: &#9; Tomcat was updated to 9.0.36 See changelog at

  - CVE-2020-11996: Fixed an issue which by sending a     specially crafted sequence of HTTP/2 requests could have     triggered high CPU usage for several seconds making     potentially the server unresponsive (bsc#1173389).

This update was imported from the SUSE:SLE-15-SP2:Update update project.

This update for tomcat fixes the following issues :

Tomcat was updated to 9.0.36 See changelog at

  - CVE-2020-11996: Fixed an issue which by sending a     specially crafted sequence of HTTP/2 requests could have     triggered high CPU usage for several seconds making     potentially the server unresponsive (bsc#1173389).

This update was imported from the SUSE:SLE-15-SP1:Update update project.

The Apache Software Foundation reports :

An h2c direct connection did not release the HTTP/1.1 processor after the upgrade to HTTP/2. If a sufficient number of such requests were made, an OutOfMemoryException could occur leading to a denial of service.

The payload length in a WebSocket frame was not correctly validated.
Invalid payload lengths could trigger an infinite loop. Multiple requests with invalid payload lengths could lead to a denial of service.

A specially crafted sequence of HTTP/2 requests could trigger high CPU usage for several seconds. If a sufficient number of such requests were made on concurrent HTTP/2 connections, the server could become unresponsive.

An update of the apache package has been released.

Several vulnerabilities were discovered in the Tomcat servlet and JSP engine, which could result in code execution or denial of service.

Several security vulnerabilities have been discovered in the Tomcat servlet and JSP engine.

CVE-2020-9484

When using Apache Tomcat and an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use the PersistenceManager with a FileStore; and c) the PersistenceManager is configured with sessionAttributeValueClassNameFilter='null' (the default unless a SecurityManager is used) or a sufficiently lax filter to allow the attacker provided object to be deserialized; and d) the attacker knows the relative file path from the storage location used by FileStore to the file the attacker has control over; then, using a specifically crafted request, the attacker will be able to trigger remote code execution via deserialization of the file under their control. Note that all of conditions a) to d) must be true for the attack to succeed.

CVE-2020-11996

A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat could trigger high CPU usage for several seconds. If a sufficient number of such requests were made on concurrent HTTP/2 connections, the server could become unresponsive.

For Debian 9 stretch, these problems have been fixed in version 8.5.54-0+deb9u2.

We recommend that you upgrade your tomcat8 packages.

For the detailed security status of tomcat8 please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/tomcat8

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Tomcat installed on the remote host is prior to 9.0.36. It is, therefore, affected by a vulnerability as referenced in the fixed_in_apache_tomcat_9.0.36_security-9 advisory.

  - A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to     9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU usage for several seconds. If a sufficient number of     such requests were made on concurrent HTTP/2 connections, the server could become unresponsive.
    (CVE-2020-11996)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Tomcat installed on the remote host is prior to 8.5.56. It is, therefore, affected by a vulnerability as referenced in the fixed_in_apache_tomcat_8.5.56_security-8 advisory.

  - A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to     9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU usage for several seconds. If a sufficient number of     such requests were made on concurrent HTTP/2 connections, the server could become unresponsive.
    (CVE-2020-11996)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
202296	RHEL 8 : tomcat (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
191754	IBM Engineering Requirements Management DOORS 9.7.2.x < 9.7.2.8 Multiple Vulnerabilities (7124058)	Nessus	Windows	critical
164612	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.17.1)	Nessus	Misc.	critical
164595	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.18)	Nessus	Misc.	critical
164582	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.16.1.3)	Nessus	Misc.	critical
150938	Apache Tomcat 10.0.0.M1 < 10.0.0.M6	Nessus	Web Servers	high
701331	Apache Tomcat < 10.0.0-M6 Vulnerability	Nessus Network Monitor	Web Servers	medium
147719	JFrog < 7.7.0 Multiple Vulnerabilities	Nessus	Misc.	high
143199	RHEL 6 / 7 / 8 : Red Hat JBoss Web Server 5.4 security (Moderate) (RHSA-2020:5170)	Nessus	Red Hat Local Security Checks	high
141862	Ubuntu 20.04 LTS : Tomcat vulnerabilities (USN-4596-1)	Nessus	Ubuntu Local Security Checks	high
112561	Apache Tomcat 8.5.x < 8.5.56 Denial of Service	Web App Scanning	Component Vulnerability	high
112560	Apache Tomcat 9.0.0.M1 < 9.0.36 Denial of Service	Web App Scanning	Component Vulnerability	high
112559	Apache Tomcat 10.0.0-M1 < 10.0.0-M6 Denial of Service	Web App Scanning	Component Vulnerability	high
139159	EulerOS 2.0 SP8 : tomcat (EulerOS-SA-2020-1829)	Nessus	Huawei Local Security Checks	high
138987	openSUSE Security Update : tomcat (openSUSE-2020-1063)	Nessus	SuSE Local Security Checks	high
138983	openSUSE Security Update : tomcat (openSUSE-2020-1051)	Nessus	SuSE Local Security Checks	high
138923	FreeBSD : Apache Tomcat -- Multiple Vulnerabilities (6a72eff7-ccd6-11ea-9172-4c72b94353b5)	Nessus	FreeBSD Local Security Checks	high
138814	Photon OS 2.0: Apache PHSA-2020-2.0-0263	Nessus	PhotonOS Local Security Checks	high
138812	Photon OS 3.0: Apache PHSA-2020-3.0-0114	Nessus	PhotonOS Local Security Checks	high
138647	Debian DSA-4727-1 : tomcat9 - security update	Nessus	Debian Local Security Checks	high
138516	Photon OS 1.0: Apache PHSA-2020-1.0-0308	Nessus	PhotonOS Local Security Checks	high
138393	Debian DLA-2279-1 : tomcat8 security update	Nessus	Debian Local Security Checks	high
138098	Apache Tomcat 9.0.0.M1 < 9.0.36	Nessus	Web Servers	high
138097	Apache Tomcat 8.5.0 < 8.5.56	Nessus	Web Servers	high

Detections

Analytics

CVE-2020-11996

high

Tenable Plugins

high

critical

critical

critical

critical

high

medium

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high