CVE-2019-10072 — Uncontrolled Resource Consumption in Apache Tomcat
Severity
7.5HIGHNVD
EPSS
71.3%
top 1.28%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedJun 21
Latest updateOct 15
Description
The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write in Apache Tomcat versions 9.0.0.M1 to 9.0.19 and 8.5.0 to 8.5.40 . By not sending WINDOW_UPDATE messages for the connection window (stream 0) clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6
Affected Packages2 packages
🔴Vulnerability Details
6OSV▶
CVE-2019-10072: The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write in Apache Tomcat versions 9↗2019-06-21
📋Vendor Advisories
7Oracle▶
Oracle Oracle Siebel CRM Risk Matrix: Mktg/Campaign Mgmt (Apache Tomcat) — CVE-2019-10072↗2020-10-15
Oracle▶
Oracle Oracle Communications Applications Risk Matrix: Core (Apache Tomcat) — CVE-2019-10072↗2020-04-15
Oracle▶
Oracle Oracle Database Server Risk Matrix: Workload Manager (Apache Tomcat) — CVE-2019-10072↗2020-01-15
💬Community
3Bugzilla▶
CVE-2019-10072 tomcat: HTTP/2 connection window exhaustion on write, incomplete fix of CVE-2019-0199↗2019-06-25
Bugzilla▶
CVE-2019-10072 tomcat: HTTP/2 connection window exhaustion on write, incomplete fix of CVE-2019-0199 [epel-all]↗2019-06-25
Bugzilla▶
CVE-2019-10072 tomcat: HTTP/2 connection window exhaustion on write, incomplete fix of CVE-2019-0199 [fedora-all]↗2019-06-25