Red Hat Security AdvisoryRHSA-2020:3305
Red Hat JBoss Web Server 3.1 Service Pack 10 security update
Released 2020-08-04 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat JBoss Web Server 3.1
Fixes 2 records
Priority HIGH 81
The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.86608 · Published 2020-07-14 · Partial fix · 10.0.0-M7, 9.0.37 +2 CWE-835
Priority MEDIUM 40
In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach to end-of-line parsing that allowed some invalid HTTP headers to be parsed as valid.
CVSS 3.1MEDIUM 4.8· Network · No auth · No interaction · EPSS 0.09386 · Published 2020-02-24 · Partial fix · 7.0.100, 8.5.51 +1 CWE-444
