CVE-2019-0199

CVE-2019-0199: vulnerability in Apache Tomcat

Published · Updated

Follow this CVE+ Monitor Apache Tomcat+ Monitor tomcat9

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

25Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 73%
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Affected
2 products
Red Hat Enterprise Linux 8 · Red Hat support for Spring Boot
no_fix_planned: Will not fix
Fixed
5 products (85 components)
Red Hat JBoss Web Server 5.2 for RHEL 6 Server · Red Hat JBoss Web Server 5.2 for RHEL 7 Server · Red Hat JBoss Web Server 5.2 for RHEL 8 · Red Hat JBoss Web Server 5 · Red Hat Runtimes Spring Boot 2.1.12
fix ↗
Not affected
19 products (57 components) — because the vulnerable code is not present in the product
Red Hat JBoss Enterprise Web Server 2 · Red Hat Enterprise Linux 6 · Red Hat Enterprise Linux 7 · Red Hat Software Collections · Red Hat JBoss Web Server 3 · and others 14
The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open without reading/writing request/response data. By keeping streams open for requests that utilised the Servlet API's blocking I/O, clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.
Affected products
n/a · Apache Tomcat