Apache Tomcat: Information disclosure — GLSA 202012-23

A vulnerability has been discovered in Apache Tomcat that allows for the disclosure of sensitive information.

Affected packages

www-servers/tomcat on all architectures
Affected versions < 8.5.60
< 9.0.40
Unaffected versions >= 8.5.60
>= 9.0.40

Background

Apache Tomcat is a Servlet-3.0/JSP-2.2 Container.

Description

It was discovered that Apache Tomcat could re-use an HTTP request header value from the previous stream received on an HTTP/2 connection for the request associated with the subsequent stream.

Impact

A remote attacker, by sending well-timed HTTP/2 requests, could possibly obtain sensitive information.

Workaround

Disable HTTP/2 support.

Resolution

All Apache Tomcat 8.5.x users should upgrade to the latest version:

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=www-servers/tomcat-8.5.60:8.5"
 

All Apache Tomcat 9.x users should upgrade to the latest version:

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=www-servers/tomcat-9.0.40:9"
 

References

Release date
December 24, 2020

Latest revision
December 24, 2020: 1

Severity
low

Exploitable
remote

Bugzilla entries