Is CVE-2019-0199 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2019-0199 being exploited in the wild.

How severe is CVE-2019-0199?

High severity, with a CVSS score of 7.5, published 15 June 2020.

Which products and versions are affected?

Apache Tomcat 9.0.0.M1 to 9.0.14, 8.5.0 to 8.5.37; org.apache.tomcat:tomcat-coyote (Maven) ECOSYSTEM:introduced=9.0.0,fixed=9.0.16; org.apache.tomcat.embed:tomcat-embed-core (Maven) ECOSYSTEM:introduced=9.0.0,fixed=9.0.16.

How is CVE-2019-0199 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2019-0199?

Check whether you run Apache Tomcat, org.apache.tomcat:tomcat-coyote (Maven) or org.apache.tomcat.embed:tomcat-embed-core (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2019-0199: Apache Tomcat Denial of Service in HTTP/2 implementation

CVE-2019-0199 · Severity: high · CVSS 7.5 · Published 2020-06-15

Apache Tomcat is a widely used web server for hosting Java-based applications. A flaw in its handling of modern web traffic (HTTP/2) allows an attacker to overwhelm the server by keeping connections open without sending data. This can lead to a complete service outage, preventing legitimate users from accessing hosted applications.

Technologies: Apache Tomcat, org.apache.tomcat:tomcat-coyote (Maven), org.apache.tomcat.embed:tomcat-embed-core (Maven). Vendors: Apache, Maven.

Quick answers

Is CVE-2019-0199 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2019-0199 being exploited in the wild.
How severe is CVE-2019-0199?: High severity, with a CVSS score of 7.5, published 15 June 2020.
Which products and versions are affected?: Apache Tomcat 9.0.0.M1 to 9.0.14, 8.5.0 to 8.5.37; org.apache.tomcat:tomcat-coyote (Maven) ECOSYSTEM:introduced=9.0.0,fixed=9.0.16; org.apache.tomcat.embed:tomcat-embed-core (Maven) ECOSYSTEM:introduced=9.0.0,fixed=9.0.16.
Is there a fix for CVE-2019-0199?: Yes. org.apache.tomcat:tomcat-coyote (Maven): upgrade to 9.0.16 or later; org.apache.tomcat.embed:tomcat-embed-core (Maven): upgrade to 9.0.16 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2019-0199 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2019-0199?: Check whether you run Apache Tomcat, org.apache.tomcat:tomcat-coyote (Maven) or org.apache.tomcat.embed:tomcat-embed-core (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

org.apache.tomcat:tomcat-coyote (Maven): upgrade to 9.0.16 or later

# set org.apache.tomcat:tomcat-coyote to 9.0.16 in your pom.xml or build.gradle

org.apache.tomcat.embed:tomcat-embed-core (Maven): upgrade to 9.0.16 or later

# set org.apache.tomcat.embed:tomcat-embed-core to 9.0.16 in your pom.xml or build.gradle

Technical details

The HTTP/2 implementation in Apache Tomcat fails to properly limit the number of SETTINGS frames and allows clients to maintain open streams without active data transfer. By exploiting the Servlet API's blocking I/O, a remote attacker can keep these streams open indefinitely, eventually exhausting the server's thread pool. This results in a Denial of Service (DoS) condition where the server can no longer process new requests. The vulnerability is patched in versions 9.0.16 and 8.5.38.

Affected products

Apache Tomcat 9.0.0.M1 to 9.0.14, 8.5.0 to 8.5.37

Identifiers

CVE-2019-0199
GHSA-qcxh-w3j9-58qr

Timeline

2019-04-10: advisory: NVD publication date
2020-06-15: disclosed: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.