Uploaded image for project: 'Jira Data Center'
  1. Jira Data Center
  2. JRASERVER-69100

Upgrade Tomcat to 8.5.38 to fix CVE-2019-0199

XMLWordPrintable

      Denial of service in Apache Tomcat CVE-2019-0199

      A vulnerability was found in Apache Tomcat version from 9.0.0.M1 to 9.0.14 inclusive and 8.5.0 to 8.5.37 inclusive. The HTTP/2 implementation accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open without reading/writing request/response data. By keeping streams open for requests that utilised the Servlet API's blocking I/O, clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.

       
      Workaround

      Upgrading to Tomcat 9.0.16 will fix the issue.

      Fixed Versions

      • >= 8.5.38
      • >= 9.0.16

            [JRASERVER-69100] Upgrade Tomcat to 8.5.38 to fix CVE-2019-0199

            lfisher made changes -
            Remote Link New: This issue links to "Page (Confluence)" [ 492979 ]
            lfisher made changes -
            Remote Link New: This issue links to "Page (Confluence)" [ 491968 ]
            David Black made changes -
            Labels Original: CVE-2019-0199 cvss-high patch-management security New: CVE-2019-0199 advisory-released cvss-high patch-management security
            David Black made changes -
            Labels Original: CVE-2019-0199 cvss-high security New: CVE-2019-0199 cvss-high patch-management security
            David Black made changes -
            Security Original: Atlassian Staff [ 10750 ]
            Przemyslaw Czuj made changes -
            Resolution New: Fixed [ 1 ]
            Status Original: Waiting for Release [ 12075 ] New: Closed [ 6 ]
            Bugfix Automation Bot made changes -
            Support reference count Original: 2 New: 3
            Przemyslaw Czuj made changes -
            Fix Version/s New: 8.2.2 [ 87096 ]
            Fix Version/s Original: 8.2.1 [ 86599 ]
            Bugfix Automation Bot made changes -
            Support reference count Original: 1 New: 2
            Pawel Drygas (Inactive) made changes -
            Fix Version/s New: 8.2.1 [ 86599 ]

              pprzytarski Pawel Przytarski
              pdrygas Pawel Drygas (Inactive)
              Affected customers:
              0 This affects my team
              Watchers:
              11 Start watching this issue

                Created:
                Updated:
                Resolved: