CVE-2019-10072: Improper Locking in Apache Tomcat
Summary
CVE-2019-10072: Improper Locking in Apache Tomcat. Affects org.apache.tomcat.embed:tomcat-embed-core across 2 version ranges.
>= 8.5.0, < 8.5.41
>= 9.0.0.M1, < 9.0.20
Fixed in 8.5.41 or 9.0.20, depending on the release line you run. How to fix ↓
Also tracked for
- tomcat9 · Debian:11
The same CVE-2019-10072 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Tomcat is an open-source web server and servlet container that is used to deploy Java-based web applications. It provides a Java HTTP web server environment for running Java code. The 'org.apache.tomcat.embed:tomcat-embed-core' package is a Maven package that includes the core components of Apache Tomcat. This package is commonly used in Java projects to embed Tomcat functionality. However, versions 9.0.0.M1 to 9.0.19 and 8.5.0 to 8.5.40 of this package are vulnerable to an improper locking issue.
Vulnerability Detail
The vulnerability, identified as CVE-2019-10072, is an incomplete fix for CVE-2019-0199. It affects Apache Tomcat versions 9.0.0.M1 to 9.0.19 and 8.5.0 to 8.5.40. The issue arises from HTTP/2 connection window exhaustion on write. By not sending WINDOW_UPDATE messages for the connection window (stream 0), attackers can cause server-side threads to block, leading to thread exhaustion and a Denial of Service (DoS) attack. This vulnerability has a CVSS score of 7.5.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 8.5.0, < 8.5.418.5.41 -
>= 9.0.0.M1, < 9.0.209.0.20
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to the patched versions of Apache Tomcat to mitigate the risk.
Conclusion
The vulnerability CVE-2019-10072 in Apache Tomcat exposes a risk of Denial of Service (DoS) attacks. To mitigate this vulnerability, it is crucial to update to the patched versions of Apache Tomcat (9.0.20 or later for version 9.0.x and 8.5.41 or later for version 8.5.x). For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.tomcat.embed:tomcat-embed-core →
FAQ
Apache Tomcat is an open-source web server and servlet container that is used to deploy Java-based web applications.
Versions 9.0.0.M1 to 9.0.19 and 8.5.0 to 8.5.40 of Apache Tomcat are affected.
This vulnerability can be exploited by attackers to cause a Denial of Service (DoS) by exhausting server-side threads.
The CVSS score of this vulnerability is 7.5.
No, there is no known workaround for this vulnerability. It is recommended to update to the patched versions of Apache Tomcat.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.tomcat.embed:tomcat-embed-core.
