Apache Tomcat: Information disclosure

Apache Tomcat: Information disclosure A vulnerability has been discovered in Apache Tomcat that allows for the disclosure of sensitive information. tomcat 2020-12-24 2020-12-24 758338 remote 8.5.60 9.0.40 8.5.60 9.0.40

Apache Tomcat is a Servlet-3.0/JSP-2.2 Container.

It was discovered that Apache Tomcat could re-use an HTTP request header value from the previous stream received on an HTTP/2 connection for the request associated with the subsequent stream.

A remote attacker, by sending well-timed HTTP/2 requests, could possibly obtain sensitive information.

Disable HTTP/2 support.

All Apache Tomcat 8.5.x users should upgrade to the latest version:


      # emerge --sync
      # emerge --ask --oneshot --verbose ">=www-servers/tomcat-8.5.60:8.5"

All Apache Tomcat 9.x users should upgrade to the latest version:


      # emerge --sync
      # emerge --ask --oneshot --verbose ">=www-servers/tomcat-9.0.40:9"

CVE-2020-17527 whissi whissi