CVE-2019-10072

CVE-2019-10072: vulnerability in Apache Tomcat

Published · Updated

Follow this CVE+ Monitor Apache Tomcat+ Monitor tomcat9

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

25Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 73%
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Affected
3 products
Red Hat BPM Suite 6 · Red Hat Enterprise Linux 8 · Red Hat JBoss BRMS 6
workaround: pki-servlet-container does not use HTTP/2 in its default configuration.
Fixed
4 products (84 components)
Red Hat JBoss Web Server 5.2 for RHEL 6 Server · Red Hat JBoss Web Server 5.2 for RHEL 7 Server · Red Hat JBoss Web Server 5.2 for RHEL 8 · Red Hat JBoss Web Server 5
fix ↗
Not affected
5 products (15 components) — because the vulnerable code is not present in the product
Red Hat Enterprise Linux 7 · Red Hat Enterprise Linux 6 · Red Hat Fuse 7 · Red Hat JBoss Data Grid 7 · Red Hat JBoss Fuse 6
The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write in Apache Tomcat versions 9.0.0.M1 to 9.0.19 and 8.5.0 to 8.5.40 . By not sending WINDOW_UPDATE messages for the connection window (stream 0) clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.
Affected products
n/a · Apache Tomcat