CVE-2020-13934: Apache Tomcat denial of service via h2c connection leak

CVE-2020-13934 · Severity: high · CVSS 7.5 · Published 2022-02-08

Apache Tomcat is a widely used web server and application container for Java-based websites. A vulnerability in how it handles certain web connections (h2c) can allow an attacker to crash the server by exhausting its memory. This results in a denial of service, making the hosted applications and websites unavailable to legitimate users.

Technologies: org.apache.tomcat:tomcat (Maven), org.apache.tomcat:tomcat-coyote (Maven). Vendors: Apache Software Foundation, Maven.

Quick answers

Is CVE-2020-13934 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2020-13934 being exploited in the wild.
How severe is CVE-2020-13934?
High severity, with a CVSS score of 7.5, published 8 February 2022.
Which products and versions are affected?
Apache Software Foundation Coyote 10.0.0-M1 to 10.0.0-M5, 9.0.0.M5 to 9.0.35, 8.5.1 to 8.5.55; org.apache.tomcat:tomcat (Maven) ECOSYSTEM:introduced=10.0.0-M1,fixed=10.0.0-M6; org.apache.tomcat:tomcat-coyote (Maven) ECOSYSTEM:introduced=10.0.0-M1,fixed=10.0.0-M6.
Is there a fix for CVE-2020-13934?
Yes. org.apache.tomcat:tomcat (Maven): upgrade to 10.0.0-M6 or later; org.apache.tomcat:tomcat-coyote (Maven): upgrade to 10.0.0-M6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2020-13934 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2020-13934?
Check whether you run Apache Software Foundation Coyote, org.apache.tomcat:tomcat (Maven) or org.apache.tomcat:tomcat-coyote (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.apache.tomcat:tomcat (Maven): upgrade to 10.0.0-M6 or later
    # set org.apache.tomcat:tomcat to 10.0.0-M6 in your pom.xml or build.gradle
  • org.apache.tomcat:tomcat-coyote (Maven): upgrade to 10.0.0-M6 or later
    # set org.apache.tomcat:tomcat-coyote to 10.0.0-M6 in your pom.xml or build.gradle

Technical details

A resource leak exists in Apache Tomcat's HTTP/2 upgrade mechanism. When an h2c (HTTP/2 Cleartext) direct connection is established, the server fails to release the HTTP/1.1 processor after the protocol upgrade. An unauthenticated remote attacker can exploit this by sending a large volume of such upgrade requests, eventually triggering an OutOfMemoryException. This results in a Denial of Service (DoS) condition. The vulnerability affects versions 10.0.0-M1 to 10.0.0-M5, 9.0.0.M5 to 9.0.35, and 8.5.1 to 8.5.55. Patches are available in versions 10.0.0-M6, 9.0.36, and 8.5.56.

Affected products

  • Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M5 to 9.0.35, 8.5.1 to 8.5.55
  • Apache Tomcat Coyote 10.0.0-M1 to 10.0.0-M5, 9.0.0.M5 to 9.0.35, 8.5.1 to 8.5.55

Identifiers

  • CVE-2020-13934
  • GHSA-vf77-8h7g-gghp

Timeline

  • 2020-07-14: disclosed: NVD publication date
  • 2021-04-12: advisory: GitHub reviewed the advisory
  • 2022-02-08: advisory: GitHub Advisory Database publication

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.