USN-4448-1

Dashboard / Vulnerabilities / USN-4448-1

USN-4448-1

Summary: tomcat8 vulnerabilities

Details: It was discovered that Tomcat incorrectly validated the payload length in a WebSocket frame. A remote attacker could possibly use this issue to cause Tomcat to hang, resulting in a denial of service. (CVE-2020-13935) It was discovered that Tomcat incorrectly handled HTTP header parsing. In certain environments where Tomcat is located behind a reverse proxy, a remote attacker could possibly use this issue to perform HTTP Reqest Smuggling. (CVE-2020-1935) It was discovered that Tomcat incorrectly handled certain uncommon PersistenceManager with FileStore configurations. A remote attacker could possibly use this issue to execute arbitrary code. (CVE-2020-9484)

References: https://ubuntu.com/security/notices/USN-4448-1, https://ubuntu.com/security/CVE-2020-1935, https://ubuntu.com/security/CVE-2020-9484, https://ubuntu.com/security/CVE-2020-13935