CVE-2020-17527

Published: Dec 3, 2020Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

While investigating bug 64830 it was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request header value from the previous stream received on an HTTP/2 connection for the request associated with the subsequent stream. While this would most likely lead to an error and the closure of the HTTP/2 connection, it is possible that information could leak between requests.

Affected (55)

Products: Apache: Tomcat · Netapp: Element Plug In, Oncommand System Manager · Debian: Debian Linux · +1 more

Show all products

Apache: Tomcat · Netapp: Element Plug In, Oncommand System Manager · Debian: Debian Linux · Oracle: Blockchain Platform, Communications Cloud Native Core Binding Support Function, Communications Cloud Native Core Policy, Communications Instant Messaging Server, Instantis Enterprisetrack, Mysql Enterprise Monitor, Sd Wan Edge, Workload Manager

1 product

2 products

Oncommand System Manager

1 product

8 products

Communications Cloud Native Core Binding Support Function

Communications Cloud Native Core Policy

Communications Instant Messaging Server

Instantis Enterprisetrack

Mysql Enterprise Monitor

Sd Wan Edge

Workload Manager

Configuration A

40 vulnerable

Vulnerable Software	Affected Versions
Apache Tomcat	From 8.5.1 to 8.5.59
Apache Tomcat	From 9.0.1 to 9.0.35
Apache Tomcat	Version 10.0.0 milestone1
Apache Tomcat	Version 10.0.0 milestone2
Apache Tomcat	Version 10.0.0 milestone3
Apache Tomcat	Version 10.0.0 milestone4
Apache Tomcat	Version 10.0.0 milestone5
Apache Tomcat	Version 10.0.0 milestone6
Apache Tomcat	Version 10.0.0 milestone7
Apache Tomcat	Version 10.0.0 milestone8
Apache Tomcat	Version 10.0.0 milestone9
Apache Tomcat	Version 9.0.0 milestone10
Apache Tomcat	Version 9.0.0 milestone11
Apache Tomcat	Version 9.0.0 milestone12
Apache Tomcat	Version 9.0.0 milestone13
Apache Tomcat	Version 9.0.0 milestone14
Apache Tomcat	Version 9.0.0 milestone15
Apache Tomcat	Version 9.0.0 milestone16
Apache Tomcat	Version 9.0.0 milestone17
Apache Tomcat	Version 9.0.0 milestone18
Apache Tomcat	Version 9.0.0 milestone19
Apache Tomcat	Version 9.0.0 milestone20
Apache Tomcat	Version 9.0.0 milestone21
Apache Tomcat	Version 9.0.0 milestone22
Apache Tomcat	Version 9.0.0 milestone23
Apache Tomcat	Version 9.0.0 milestone24
Apache Tomcat	Version 9.0.0 milestone25
Apache Tomcat	Version 9.0.0 milestone26
Apache Tomcat	Version 9.0.0 milestone27
Apache Tomcat	Version 9.0.0 milestone5
Apache Tomcat	Version 9.0.0 milestone6
Apache Tomcat	Version 9.0.0 milestone7
Apache Tomcat	Version 9.0.0 milestone8
Apache Tomcat	Version 9.0.0 milestone9
Apache Tomcat	Version 9.0.35-3.39.1
Apache Tomcat	Version 9.0.35-3.57.3
Apache Tomcat	Version 9.0.36
Apache Tomcat	Version 9.0.37
Apache Tomcat	Version 9.0.38
Apache Tomcat	Version 9.0.39

Configuration B

2 vulnerable

Vulnerable Software	Affected Versions
Netapp Element Plug In	All versions
Netapp Oncommand System Manager	From 3.0.0 to 3.1.3

Configuration C

2 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 10.0
Debian Debian Linux	Version 9.0

Configuration D

11 vulnerable

Vulnerable Software	Affected Versions
Oracle Blockchain Platform	Before 21.1.2
Oracle Communications Cloud Native Core Binding Support Function	Version 1.10.0
Oracle Communications Cloud Native Core Policy	Version 1.14.0
Oracle Communications Instant Messaging Server	Version 10.0.1.5.0
Oracle Instantis Enterprisetrack	Version 17.1
Oracle Instantis Enterprisetrack	Version 17.2
Oracle Instantis Enterprisetrack	Version 17.3
Oracle Mysql Enterprise Monitor	Before 8.0.23
Oracle Sd Wan Edge	Version 9.0
Oracle Workload Manager	Version 18c
Oracle Workload Manager	Version 19c

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (54)

http://www.openwall.com/lists/oss-security/2020/12/03/3

Source: security@apache.org

Mailing ListThird Party Advisory

https://lists.apache.org/thread.html/r26a2a66339087fc37db3caf201e446d3e83b5cce314371e235ff1784%40%3Ccommits.tomee.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/r2d6e05c5ff96f8068a59dfdb3800e9ee8d4e36ce1971783c6e5f9b20%40%3Ccommits.tomee.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/r5a285242737ddef4d338236328aaaf3237183e1465a5efafd16b99ed%40%3Cdev.tomcat.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/r8a227ac6a755a6406c1cc47dd48800e973d4cf13fe7fe68ac59c679c%40%3Cdev.tomcat.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/r9fd47f1b03e9b41d16a5cf72659b533887267d3398d963c2fff3abfa%40%3Ccommits.tomee.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/ra35c8d617b17d59f400112cebadec43ad379f98198b4a9726190d7ee%40%3Cissues.guacamole.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/ra9fcdb904dd2e2256ef90b3e4ced279cd464cb0ab63a6c64df5c010d%40%3Cannounce.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/ra9fcdb904dd2e2256ef90b3e4ced279cd464cb0ab63a6c64df5c010d%40%3Cannounce.tomcat.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/raa0e9ad388c1e6fd1e301b5e080f9439f64cb4178119a86a4801cc53%40%3Cdev.tomcat.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/rabbe6b3ae6a9795641d7a05c00d2378d5bbbe4240b7e20f09b092cce%40%3Cissues.guacamole.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/rbba08c4dcef3603e36276d49adda8eedbe458c5104314b4038f697e1%40%3Cusers.tomcat.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/rca833c6d42b7b9ce1563488c0929f29fcc95947d86e5e740258c8937%40%3Cdev.tomcat.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/rce5ac9a40173651d540babce59f6f3825f12c6d4e886ba00823b11e5%40%3Cannounce.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/rce5ac9a40173651d540babce59f6f3825f12c6d4e886ba00823b11e5%40%3Cannounce.tomcat.apache.org%3E

Source: security@apache.org

Mailing ListVendor Advisory

https://lists.apache.org/thread.html/rce5ac9a40173651d540babce59f6f3825f12c6d4e886ba00823b11e5%40%3Cannounce.tomcat.apache.org%3E

Source: security@apache.org

Mailing ListVendor Advisory

https://lists.apache.org/thread.html/rce5ac9a40173651d540babce59f6f3825f12c6d4e886ba00823b11e5%40%3Cannounce.tomcat.apache.org%3E

Source: security@apache.org

Mailing ListVendor Advisory

https://lists.apache.org/thread.html/rce5ac9a40173651d540babce59f6f3825f12c6d4e886ba00823b11e5%40%3Cannounce.tomcat.apache.org%3E

Source: security@apache.org

Mailing ListVendor Advisory

https://lists.apache.org/thread.html/rd5babd13d7a350b369b2f647b4dd32ce678af42f9aba5389df1ae6ca%40%3Cusers.tomcat.apache.org%3E

Source: security@apache.org

https://lists.debian.org/debian-lts-announce/2020/12/msg00022.html

Source: security@apache.org

Mailing ListThird Party Advisory

https://security.gentoo.org/glsa/202012-23

Source: security@apache.org

Third Party Advisory

https://security.netapp.com/advisory/ntap-20201210-0003/

Source: security@apache.org

Third Party Advisory

https://www.debian.org/security/2021/dsa-4835

Source: security@apache.org

Third Party Advisory

https://www.oracle.com//security-alerts/cpujul2021.html

Source: security@apache.org

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpuApr2021.html

Source: security@apache.org

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpuapr2022.html

Source: security@apache.org

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpujan2022.html

Source: security@apache.org

PatchThird Party Advisory

http://www.openwall.com/lists/oss-security/2020/12/03/3