CVE: 2020-13934 found in tomcat-embed-core - Version: 9.0.36 [JAVA]

[Rajkumarr77]

Veracode Software Composition Analysis

Attribute	Details
Library	tomcat-embed-core
Description	Core Tomcat implementation
Language	JAVA
Vulnerability	Denial Of Service (DoS)
Vulnerability description	apache tomcat is vulnerable to denial of service. The HTTP/1.1 processor is not released after an upgrade to HTTP/2, allowing an attacker to cause a denial of service condition due to an OutOfMemoryException by sending a large number of upgrade requests.
CVE	2020-13934
CVSS score	5
Vulnerability present in version/s	9.0.0.M6-9.0.36
Found library version/s	9.0.36
Vulnerability fixed in version	9.0.37
Library latest version	11.0.9
Fix

Links:

• https://sca.analysiscenter.veracode.com/vulnerability-database/libraries/1334?version=9.0.36
• https://sca.analysiscenter.veracode.com/vulnerability-database/vulnerabilities/25888
• Patch: apache/tomcat@172977f