CVE-2020-11996

描述

A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0 to 10.0.0, 9.0.0 to 9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU usage for several seconds. If a sufficient number of such requests were made on concurrent HTTP/2 connections, the server could become unresponsive.

如何修補 CVE-2020-11996

要修補 CVE-2020-11996,請將受影響套件升級到下列已修補版本。

• Bitnami/tomcat—升級至 8.5.56 或更新版本
• —升級至 8.5.54-0+deb9u2 或更新版本
• —升級至 9.0.36-1 或更新版本
• —升級至 9.0.31-1~deb10u2 或更新版本
• —升級至 10.0.0-M5 或更新版本
• —升級至 10.0.0-M5 或更新版本

CVE-2020-11996 正在被利用嗎?

中等 — EPSS 為 26.7%,可持續追蹤但非最高優先。

受影響套件(6)

• >= 8.5.0, < 8.5.56, >= 9.0.0, < 9.0.36
• from 0, < 8.5.54-0+deb9u2
• from 0, < 9.0.36-1
• from 0, < 9.0.31-1~deb10u2
• >= 10.0.0-M1, < 10.0.0-M5
• >= 10.0.0-M1, < 10.0.0-M5

CVSS 分數

參考連結(50)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2020-11996
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2020-11996
• PATCHgithub.com/apache/tomcat
• WEBlists.opensuse.org/opensuse-security-announce/2020-07/msg00064.html