-
Bug
-
Resolution: Done
-
Medium
-
7.5.2
-
22
-
Severity 2 - Major
-
51
-
Issue Summary
- The current version of Tomcat 9.0.33 bundled with Confluence (at least up to Confluence version 7.6) is vulnerable to HTTP/2 Denial of Service CVE-2020-11996
https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_9.0.36
http://mail-archives.us.apache.org/mod_mbox/www-announce/202006.mbox/%3Cfd56bc1d-1219-605b-99c7-946bf7bd8ad4%40apache.org%3E
This vulnerability uses "(a) specially crafted sequence of HTTP/2 requests" to "trigger high CPU usage for several seconds." A large number of these HTTP/2 requests could be used to make an application unresponsive.
Versions Affected:
- Apache Tomcat 10.0.0-M1 to 10.0.0-M5
- Apache Tomcat 9.0.0.M1 to 9.0.35
- Apache Tomcat 8.5.0 to 8.5.55
Versions affected:
- Apache Tomcat 10.0.0-M6 or later
- Apache Tomcat 9.0.36 or later
- Apache Tomcat 8.5.56 or later
Notes
- By default Confluence is configured to use an HTTP/1.1 connector and would not be vulnerable to this CVE
Mitigation
- No workaround is needed to mitigate this vulnerability.
- If your organization determines that you cannot use a version of Tomcat that is affected by CVE-2020-11996 you can manually update the version of Tomcat used by Confluence to an unaffected version (9.0.37) as described in How to Upgrade The Tomcat Container for Confluence
- Note: Manually upgrading the version of Tomcat used by Confluence is not supported. If any issues arise from making this change, Atlassian Support would first recommend going back to a supported version of Tomcat.
- is incorporated by
-
-
- Closed
-
- relates to
-
CONFSERVER-59863 Upgrade Tomcat to the fixed version of CVE-2020-9484
- Closed
-
PSHELP-1511 Failed to load
- resolves
-
- Closed
- mentioned in
-
Page Failed to load
-
Page Loading...
-
-
-
-
-
-
-
-
-
-
-
[CONFSERVER-60004] Upgrade Tomcat to version 9.0.37
| Remote Link | Original: This issue links to "PSHELP-1511 (Atlassian Security Jira)" [ 539193 ] | New: This issue links to "PSHELP-1511 (ASEC/J)" [ 539193 ] |
| Remote Link |
New:
This issue links to "R7.4 P1. Baseline › Main Plugins - Samurai › issue-74- |
| Remote Link |
New:
This issue links to "R7.4 P1. Baseline › Main Plugins - Little Big Platform › issue-74- |
| Remote Link |
New:
This issue links to "R7.4 P1. Baseline › Main Plugins - Scale › issue-74- |
| Remote Link | New: This issue links to "PSHELP-1511 (Atlassian Security Jira)" [ 539193 ] |
| Remote Link | New: This issue links to "Page (Confluence)" [ 526638 ] |
| Remote Link | Original: This issue links to "Page (Extranet)" [ 518414 ] |
| Remote Link | New: This issue links to "Page (Extranet)" [ 525525 ] |
| Remote Link | New: This issue links to "Page (Confluence)" [ 525275 ] |
| Remote Link | New: This issue links to "Page (Confluence)" [ 524160 ] |