CVE-2019-0199

Impact:
Important
Public Date:
2019-03-25
CWE:
CWE-400
Bugzilla:
1693325: CVE-2019-0199 tomcat: Apache Tomcat HTTP/2 DoS

The MITRE CVE dictionary describes this issue as:

The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open without reading/writing request/response data. By keeping streams open for requests that utilised the Servlet API's blocking I/O, clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.

Find out more about CVE-2019-0199 from the MITRE CVE dictionary dictionary and NIST NVD.

CVSS v3 metrics

NOTE: The following CVSS v3 metrics and score provided are preliminary and subject to review.

CVSS3 Base Score 7.5
CVSS3 Base Metrics CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality None
Integrity Impact None
Availability Impact High

Affected Packages State

Platform Package State
Red Hat Software Collections for Red Hat Enterprise Linux rh-java-common-tomcat Not affected
Red Hat OpenShift Application Runtimes 1.0 springboot Not affected
Red Hat JBoss Web Server 5 tomcat Affected
Red Hat JBoss Web Server 3 tomcat7 Not affected
Red Hat JBoss Web Server 3 tomcat8 Not affected
Red Hat JBoss Operations Network 3 jbossweb Not affected
Red Hat JBoss Fuse Service Works 6 jbossweb Not affected
Red Hat JBoss Fuse 7 tomcat Not affected
Red Hat JBoss Fuse 6 tomcat Not affected
Red Hat JBoss Enterprise SOA Platform 5 jbossweb Not affected
Red Hat JBoss EWS 2 tomcat7 Not affected
Red Hat JBoss EWS 2 tomcat6 Not affected
Red Hat JBoss EAP 6 jbossweb Not affected
Red Hat JBoss EAP 5 jbossweb Not affected
Red Hat JBoss Data Virtualization 6 jbossweb Not affected
Red Hat JBoss Data Grid 7 tomcat Not affected
Red Hat JBoss Data Grid 6 jbossweb Not affected
Red Hat JBoss BRMS 6 tomcat Not affected
Red Hat JBoss BRMS 5 jbossweb Not affected
Red Hat JBoss BPMS 6 tomcat Not affected
Red Hat Enterprise Linux 8 pki-deps:10.6/pki-servlet-container Will not fix
Red Hat Enterprise Linux 7 tomcat Not affected
Red Hat Enterprise Linux 6 tomcat6 Not affected
Last Modified

CVE description copyright © 2017, The MITRE Corporation