CVE-2019-0199: Denial of Service in Apache Tomcat
Summary
CVE-2019-0199: Apache Tomcat Denial of Service vulnerability. Affects org.apache.tomcat.embed:tomcat-embed-core across 2 version ranges.
>= 8.0.0, < 8.5.38
>= 9.0.0, < 9.0.16
Fixed in 8.5.38 or 9.0.16, depending on the release line you run. How to fix ↓
Also tracked for
- tomcat9 · Debian:11
The same CVE-2019-0199 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Tomcat is an open-source web server and servlet container that is used to deploy Java-based web applications. It provides a Java Servlet and JavaServer Pages (JSP) environment for running web applications. The vulnerability, identified as CVE-2019-0199, affects Apache Tomcat versions 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37. This vulnerability allows an attacker to launch a Denial of Service (DoS) attack on the server by exploiting the HTTP/2 implementation in Tomcat. By sending excessive numbers of SETTINGS frames and keeping streams open without reading/writing request/response data, the attacker can cause server-side threads to block, leading to thread exhaustion and a DoS.
Vulnerability Detail
The vulnerability in Apache Tomcat allows an attacker to exhaust server-side threads and cause a DoS by exploiting the HTTP/2 implementation. By sending a large number of SETTINGS frames and keeping streams open without processing the data, the attacker can cause the server to run out of available threads, leading to a complete denial of service. This vulnerability has a CVSS score of 7.5, indicating a high severity level. It is important to address this vulnerability promptly to prevent potential service disruptions and downtime.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 8.0.0, < 8.5.388.5.38 -
>= 9.0.0, < 9.0.169.0.16
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to the fixed versions is not immediately possible, a temporary workaround can be implemented to mitigate the risk. One possible workaround is to disable the HTTP/2 protocol in the Tomcat configuration. By disabling HTTP/2, the vulnerability can be effectively mitigated. However, it is important to note that this workaround may impact the performance and functionality of applications that rely on HTTP/2. It is recommended to apply the fix as soon as possible.
Conclusion
The vulnerability in Apache Tomcat (CVE-2019-0199) allows an attacker to launch a Denial of Service (DoS) attack by exploiting the HTTP/2 implementation. To mitigate the risk, it is recommended to upgrade to the fixed versions of Apache Tomcat or apply the temporary workaround of disabling HTTP/2. Keeping the software up to date and following best security practices is essential to ensure the stability and security of the server. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.tomcat.embed:tomcat-embed-core →
FAQ
Apache Tomcat is an open-source web server and servlet container that is used to deploy Java-based web applications. It provides a Java Servlet and JavaServer Pages (JSP) environment for running web applications.
This vulnerability allows an attacker to launch a Denial of Service (DoS) attack on the server by exploiting the HTTP/2 implementation in Apache Tomcat. By causing server-side threads to block, the attacker can exhaust the available threads and cause a complete denial of service.
To fix this vulnerability, it is recommended to upgrade to the fixed versions of Apache Tomcat. For versions 9.0.0.M1 to 9.0.14, upgrade to version 9.0.16 or later. For versions 8.5.0 to 8.5.37, upgrade to version 8.5.38 or later.
Yes, a temporary workaround is to disable the HTTP/2 protocol in the Tomcat configuration. By disabling HTTP/2, the vulnerability can be effectively mitigated. However, this workaround may impact the performance and functionality of applications that rely on HTTP/2.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.tomcat.embed:tomcat-embed-core.
