CVE-2020-13935

Published: Jul 14, 2020Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid payload lengths could trigger an infinite loop. Multiple requests with invalid payload lengths could lead to a denial of service.

Affected (74)

Products: Apache: Tomcat · Debian: Debian Linux · Netapp: Oncommand System Manager · +4 more

Show all products

1 product

1 product

1 product

Oncommand System Manager

1 product

1 product

1 product

12 products

Agile Engineering Data Management

Agile Plm

Blockchain Platform

Commerce Guided Search

Communications Cloud Native Core Policy

Communications Instant Messaging Server

Fmw Platform

Instantis Enterprisetrack

Managed File Transfer

Mysql Enterprise Monitor

Siebel Ui Framework

Workload Manager

Configuration A

36 vulnerable

Vulnerable Software	Affected Versions
Apache Tomcat	From 7.0.27 to 7.0.104
Apache Tomcat	From 8.5.0 to 8.5.56
Apache Tomcat	From 9.0.1 to 9.0.36
Apache Tomcat	Version 10.0.0 milestone1
Apache Tomcat	Version 10.0.0 milestone2
Apache Tomcat	Version 10.0.0 milestone3
Apache Tomcat	Version 10.0.0 milestone4
Apache Tomcat	Version 10.0.0 milestone5
Apache Tomcat	Version 10.0.0 milestone6
Apache Tomcat	Version 9.0.0 milestone10
Apache Tomcat	Version 9.0.0 milestone11
Apache Tomcat	Version 9.0.0 milestone12
Apache Tomcat	Version 9.0.0 milestone13
Apache Tomcat	Version 9.0.0 milestone14
Apache Tomcat	Version 9.0.0 milestone15
Apache Tomcat	Version 9.0.0 milestone16
Apache Tomcat	Version 9.0.0 milestone17
Apache Tomcat	Version 9.0.0 milestone18
Apache Tomcat	Version 9.0.0 milestone19
Apache Tomcat	Version 9.0.0 milestone1
Apache Tomcat	Version 9.0.0 milestone20
Apache Tomcat	Version 9.0.0 milestone21
Apache Tomcat	Version 9.0.0 milestone22
Apache Tomcat	Version 9.0.0 milestone23
Apache Tomcat	Version 9.0.0 milestone24
Apache Tomcat	Version 9.0.0 milestone25
Apache Tomcat	Version 9.0.0 milestone26
Apache Tomcat	Version 9.0.0 milestone27
Apache Tomcat	Version 9.0.0 milestone2
Apache Tomcat	Version 9.0.0 milestone3
Apache Tomcat	Version 9.0.0 milestone4
Apache Tomcat	Version 9.0.0 milestone5
Apache Tomcat	Version 9.0.0 milestone6
Apache Tomcat	Version 9.0.0 milestone7
Apache Tomcat	Version 9.0.0 milestone8
Apache Tomcat	Version 9.0.0 milestone9

Configuration B

2 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 10.0
Debian Debian Linux	Version 9.0

Configuration C

1 vulnerable

Vulnerable Software	Affected Versions
Netapp Oncommand System Manager	From 3.0.0 to 3.1.3

Configuration D

2 vulnerable

Vulnerable Software	Affected Versions
Opensuse Leap	Version 15.1
Opensuse Leap	Version 15.2

Configuration E

2 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 16.04
Canonical Ubuntu Linux	Version 20.04

Configuration F

11 vulnerable

Vulnerable Software	Affected Versions
Mcafee Epolicy Orchestrator	Version 5.10.0
Mcafee Epolicy Orchestrator	Version 5.10.0 update_1
Mcafee Epolicy Orchestrator	Version 5.10.0 update_2
Mcafee Epolicy Orchestrator	Version 5.10.0 update_3
Mcafee Epolicy Orchestrator	Version 5.10.0 update_4
Mcafee Epolicy Orchestrator	Version 5.10.0 update_5
Mcafee Epolicy Orchestrator	Version 5.10.0 update_6
Mcafee Epolicy Orchestrator	Version 5.10.0 update_7
Mcafee Epolicy Orchestrator	Version 5.10.0 update_8
Mcafee Epolicy Orchestrator	Version 5.9.0
Mcafee Epolicy Orchestrator	Version 5.9.1

Configuration G

20 vulnerable

Vulnerable Software	Affected Versions
Oracle Agile Engineering Data Management	Version 6.2.1.0
Oracle Agile Plm	Version 9.3.3
Oracle Agile Plm	Version 9.3.5
Oracle Agile Plm	Version 9.3.6
Oracle Blockchain Platform	Before 21.1.2
Oracle Commerce Guided Search	Version 11.3.2
Oracle Communications Cloud Native Core Policy	Version 1.14.0
Oracle Communications Instant Messaging Server	Version 10.0.1.5.0
Oracle Fmw Platform	Version 12.2.1.3.0
Oracle Fmw Platform	Version 12.2.1.4.0
Oracle Instantis Enterprisetrack	Version 17.1
Oracle Instantis Enterprisetrack	Version 17.2
Oracle Instantis Enterprisetrack	Version 17.3
Oracle Managed File Transfer	Version 12.2.1.3.0
Oracle Managed File Transfer	Version 12.2.1.4.0
Oracle Mysql Enterprise Monitor	Up to 8.0.21
Oracle Siebel Ui Framework	Up to 20.12
Oracle Workload Manager	Version 12.2.0.1
Oracle Workload Manager	Version 18c
Oracle Workload Manager	Version 19c

Related CWEs

CWE-835

Loop with Unreachable Exit Condition ('Infinite Loop')

The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

References (34)

http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00084.html

Source: security@apache.org

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00088.html

Source: security@apache.org

Mailing ListThird Party Advisory

https://kc.mcafee.com/corporate/index?page=content&id=SB10332

Source: security@apache.org

Third Party Advisory

https://lists.apache.org/thread.html/r4e5d3c09f4dd2923191e972408b40fb8b42dbff0bc7904d44b651e50%40%3Cusers.tomcat.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/rd48c72bd3255bda87564d4da3791517c074d94f8a701f93b85752651%40%3Cannounce.tomcat.apache.org%3E

Source: security@apache.org

Mailing ListRelease NotesVendor Advisory

https://lists.debian.org/debian-lts-announce/2020/07/msg00017.html

Source: security@apache.org

Mailing ListThird Party Advisory

https://security.netapp.com/advisory/ntap-20200724-0003/

Source: security@apache.org

Third Party Advisory

https://usn.ubuntu.com/4448-1/

Source: security@apache.org

Third Party Advisory

https://usn.ubuntu.com/4596-1/

Source: security@apache.org

Third Party Advisory

https://www.debian.org/security/2020/dsa-4727

Source: security@apache.org

Third Party Advisory

https://www.oracle.com//security-alerts/cpujul2021.html

Source: security@apache.org

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpuApr2021.html

Source: security@apache.org

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpuapr2022.html

Source: security@apache.org

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpujan2021.html

Source: security@apache.org

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpujan2022.html

Source: security@apache.org

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpuoct2020.html

Source: security@apache.org

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpuoct2021.html

Source: security@apache.org

Not ApplicableThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00084.html