CVE: 2020-17527 found in tomcat-embed-core - Version: 9.0.36 [JAVA]

[Rajkumarr77]

Veracode Software Composition Analysis

Attribute	Details
Library	tomcat-embed-core
Description	Core Tomcat implementation
Language	JAVA
Vulnerability	Denial Of Service (DoS)
Vulnerability description	tomcat is vulnerable to denial of service. Re-use of an HTTP request header value from the previous stream received on an HTTP/2 connection for the request associated with the subsequent stream would most likely lead to an error and the closure of the HTTP/2 connection which allows an attacker to leak information.
CVE	2020-17527
CVSS score	5
Vulnerability present in version/s	9.0.0.M1-9.0.39
Found library version/s	9.0.36
Vulnerability fixed in version	9.0.40
Library latest version	11.0.9
Fix

Links:

• https://sca.analysiscenter.veracode.com/vulnerability-database/libraries/1334?version=9.0.36
• https://sca.analysiscenter.veracode.com/vulnerability-database/vulnerabilities/28041
• Patch: apache/tomcat@d56293f