Red Hat Security Advisory

RHSA-2021:4012

Red Hat support for Spring Boot 2.4.9 security update

Released 2021-10-28 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Support for Spring Boot 2.4.9

Fixes 2 records

TI-2020-13275 CVE-2020-17527 · GHSA-vvw4-rfwf-p6hx

Apache Tomcat: Request header mix-up between HTTP/2 streams

MEDIUM 60

While investigating bug 64830 it was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request header value from the previous stream received on an HTTP/2 c…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.24622 Published 2020-12-03 Partial fix · 10.0.0-M10, 9.0.40 +1 CWE-200

TI-2020-10919 CVE-2020-13943 · GHSA-f268-65qc-98vg

Information disclosure in Apache Tomcat

MEDIUM 58

If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the HTTP/2 protocol…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.52639 Published 2020-10-12 Partial fix · 10.0.0-M8, 9.0.38 +1 CWE-200