Allele Security Alert
ASA-2019-00371
Identifier(s)
ASA-2019-00371, CVE-2019-10072
Title
HTTP/2 DoS
Vendor(s)
The Apache Software Foundation
Product(s)
Apache Tomcat
Affected version(s)
Apache Tomcat versions 9.0.0.M1 to 9.0.19
Apache Tomcat versions 8.5.0 to 8.5.40
Fixed version(s)
Apache Tomcat 9.0.20 or later
Apache Tomcat 8.5.41 or later
Proof of concept
Unknown
Description
The fix for CVE-2019-0199 was incomplete and did not address connection window exhaustion on write. By not sending WINDOW_UPDATE messages for the connection window (stream 0) clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.
Technical details
Unknown
Credits
John Simpson (Trend Micro Security Research)
Reference(s)
[SECURITY][CORRECTION] CVE-2019-10072 Apache Tomcat HTTP/2 DoS
https://mail-archives.us.apache.org/mod_mbox/www-announce/201906.mbox/%3Cca69531a-1592-be7b-60ce-729549c7f812%40apache.org%3E
Apache Tomcat – Apache Tomcat 9 vulnerabilities
http://tomcat.apache.org/security-9.html
Apache Tomcat – Apache Tomcat 8 vulnerabilities
http://tomcat.apache.org/security-8.html
Expand HTTP/2 timeout handling to connection window exhaustion on write.
https://github.com/apache/tomcat/commit/7f748eb
Fix test failures. Handle full allocation case.
https://github.com/apache/tomcat/commit/ada725a
CVE-2019-10072
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10072
CVE-2019-10072
https://nvd.nist.gov/vuln/detail/CVE-2019-10072
If there is any error in this alert or you wish a comprehensive analysis, let us know.
Last modified: October 2, 2019