A vulnerability has been discovered in Apache Tomcat that allows for the disclosure of sensitive information.
|Package||www-servers/tomcat on all architectures|
|Affected versions||< 8.5.60
|Unaffected versions||>= 8.5.60
Apache Tomcat is a Servlet-3.0/JSP-2.2 Container.
It was discovered that Apache Tomcat could re-use an HTTP request header value from the previous stream received on an HTTP/2 connection for the request associated with the subsequent stream.
A remote attacker, by sending well-timed HTTP/2 requests, could possibly obtain sensitive information.
Disable HTTP/2 support.
All Apache Tomcat 8.5.x users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=www-servers/tomcat-8.5.60:8.5"
All Apache Tomcat 9.x users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=www-servers/tomcat-9.0.40:9"
December 24, 2020
December 24, 2020: 1