CVE-2020-13935
published 2020-09-09CVE-2020-13935: A flaw was found in JBossWeb in versions before 7.5.31.Final-redhat-3. The fix for CVE-2020-13935 was incomplete in JBossWeb, leaving it vulnerable to a denial…
PriorityP268high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EXPLOIT
EPSS
87.55%
99.7th percentile
A flaw was found in JBossWeb in versions before 7.5.31.Final-redhat-3. The fix for CVE-2020-13935 was incomplete in JBossWeb, leaving it vulnerable to a denial of service attack when sending multiple requests with invalid payload length in a WebSocket frame. The highest threat from this vulnerability is to system availability.
Affected
39 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | 7.0.27 – 7.0.104 | — |
| apache | tomcat | 8.5.0 – 8.5.56 | — |
| apache | tomcat | 9.0.1 – 9.0.36 | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | tomcat9 | < tomcat9 9.0.37-1 (bookworm) | tomcat9 9.0.37-1 (bookworm) |
| mcafee | epolicy_orchestrator | — | — |
| mcafee | epolicy_orchestrator | — | — |
| mcafee | epolicy_orchestrator | — | — |
| netapp | oncommand_system_manager | 3.0.0 – 3.1.3 | — |
| opensuse | leap | — | — |
| opensuse | leap | — | — |
| oracle | agile_engineering_data_management | — | — |
| oracle | agile_plm | — | — |
| oracle | agile_plm | — | — |
| oracle | agile_plm | — | — |
| oracle | blockchain_platform | < 21.1.2 | 21.1.2 |
| oracle | commerce_guided_search | — | — |
| oracle | communications_cloud_native_core_policy | — | — |
| oracle | communications_instant_messaging_server | — | — |
Detection & IOCsextracted from sources · hover to see the quote
path/examples/websocket/echo.xhtml
path/examples/websocket/echoProgrammatic
bytes
0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF (64-bit WebSocket payload length field with all bits set to 1)
bytes
WebSocket frame byte 2: 0xFF (mask bit set + payload length 127 indicator: 1<<7 | 0b1111111)
- →Exploit targets the WebSocket echo endpoint at /examples/websocket/echoProgrammatic via a raw WebSocket frame with the 64-bit extended payload length field set to 0xFFFFFFFFFFFFFFFF (all bits 1), which violates RFC 6455 (MSB must be 0) and triggers an infinite loop in Tomcat's WebSocket processor.
- →The exploit sends 3 concurrent goroutines each writing the malformed WebSocket frame; detection should look for multiple simultaneous WebSocket connections to /examples/websocket/echoProgrammatic that do not complete a clean close handshake.
- →A vulnerable Tomcat instance will NOT return the error string 'websocket: close 1002 (protocol error): An invalid WebSocket frame was received - the most significant bit of a 64-bit payload was illegally set'; absence of this error combined with an i/o timeout on the attacker side indicates successful DoS trigger.
- →Shodan query 'html:"Apache Tomcat"' can be used to identify potentially exposed Tomcat instances for asset inventory and patch verification.
- →Probe for the vulnerable echo page at /examples/websocket/echo.xhtml; a 200 response containing 'Apache Tomcat WebSocket Examples: Echo' confirms the WebSocket examples are exposed and the instance may be vulnerable.
- ·Red Hat Certificate System 10.0 and RHEL 8 Identity Management bundle a vulnerable Tomcat version in pki-servlet-engine, but there is no WebSocket entry point in supported configurations, making exploitation impossible in those setups. ↗
- ·Red Hat OpenStack Platform 13 does not ship with WebSocket functionality enabled by default, reducing exposure. ↗
- ·JBossWeb received an incomplete fix for CVE-2020-13935 (tracked as CVE-2020-14384); versions before 7.5.31.Final-redhat-3 remain vulnerable despite the initial patch. ↗
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
osv7.5HIGH
vendor_apache7.5HIGH
vendor_debian7.5HIGH
vendor_oracle7.5HIGH
vendor_redhat7.5HIGH
vendor_ubuntu7.5HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Oracle
Oracle Oracle Commerce Risk Matrix: Endeca Application Controller (Apache Tomcat) — CVE-2020-13935
vendor_oracle·2022-01-15·CVSS 7.5
CVE-2020-13935 [HIGH] Oracle Oracle Commerce Risk Matrix: Endeca Application Controller (Apache Tomcat) — CVE-2020-13935
Oracle Oracle Commerce Risk Matrix: Endeca Application Controller (Apache Tomcat) vulnerability
CVE: CVE-2020-13935
CVSS: 7.5
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpujan2022 (JAN 2022)
Oracle
Oracle Oracle Supply Chain Risk Matrix: Installation Issues (Apache Tomcat) — CVE-2020-13935
vendor_oracle·2021-07-15·CVSS 7.5
CVE-2020-13935 [HIGH] Oracle Oracle Supply Chain Risk Matrix: Installation Issues (Apache Tomcat) — CVE-2020-13935
Oracle Oracle Supply Chain Risk Matrix: Installation Issues (Apache Tomcat) vulnerability
CVE: CVE-2020-13935
CVSS: 7.5
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpujul2021 (JUL 2021)
Oracle
Oracle Oracle Fusion Middleware Risk Matrix: MFT Runtime Server (Apache Tomcat) — CVE-2020-13935
vendor_oracle·2021-01-15·CVSS 7.5
CVE-2020-13935 [HIGH] Oracle Oracle Fusion Middleware Risk Matrix: MFT Runtime Server (Apache Tomcat) — CVE-2020-13935
Oracle Oracle Fusion Middleware Risk Matrix: MFT Runtime Server (Apache Tomcat) vulnerability
CVE: CVE-2020-13935
CVSS: 7.5
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpujan2021 (JAN 2021)
Ubuntu
Tomcat vulnerabilities
vendor_ubuntu·2020-10-21·CVSS 7.5
CVE-2020-9484 [HIGH] Tomcat vulnerabilities
Title: Tomcat vulnerabilities
Summary: Several security issues were fixed in Tomcat.
It was discovered that Tomcat did not properly manage HTTP/2 streams. An
attacker could possibly use this to cause Tomcat to consume resources,
resulting in a denial of service. (CVE-2020-11996)
It was discovered that Tomcat did not properly release the HTTP/1.1
processor after the upgrade to HTTP/2. An attacker could possibly use this
to generate an OutOfMemoryException, resulting in a denial of service.
(CVE-2020-13934)
It was discovered that Tomcat did not properly validate the payload length
in a WebSocket frame. An attacker could possibly use this to trigger an
infinite loop, resulting in a denial of service. (CVE-2020-13935)
It was discovered that Tomcat did not properly deserialize untrusted da
Oracle
Oracle Oracle Database Server Risk Matrix: Workload Manager (Apache Tomcat) — CVE-2020-13935
vendor_oracle·2020-10-15·CVSS 7.5
CVE-2020-13935 [HIGH] Oracle Oracle Database Server Risk Matrix: Workload Manager (Apache Tomcat) — CVE-2020-13935
Oracle Oracle Database Server Risk Matrix: Workload Manager (Apache Tomcat) vulnerability
CVE: CVE-2020-13935
CVSS: 7.5
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpuoct2020 (OCT 2020)
Red Hat
jbossweb: Incomplete fix of CVE-2020-13935 for WebSocket in JBossWeb could lead to DoS
vendor_redhat·2020-09-03·CVSS 7.5
CVE-2020-14384 [HIGH] CWE-400 jbossweb: Incomplete fix of CVE-2020-13935 for WebSocket in JBossWeb could lead to DoS
jbossweb: Incomplete fix of CVE-2020-13935 for WebSocket in JBossWeb could lead to DoS
A flaw was found in JBossWeb in versions before 7.5.31.Final-redhat-3. The fix for CVE-2020-13935 was incomplete in JBossWeb, leaving it vulnerable to a denial of service attack when sending multiple requests with invalid payload length in a WebSocket frame. The highest threat from this vulnerability is to system availability.
A flaw was found in jbossweb. The fix for CVE-2020-13935 was incomplete in JBossWeb, leaving it vulnerable to a denial of service attack when sending multiple requests with invalid payload length in a WebSocket frame. The highest threat from this vulnerability is to system availability.
Mitigation: Red Hat has investigated whether a possible mitigation exists for this issue, and
Ubuntu
Tomcat vulnerabilities
vendor_ubuntu·2020-08-04·CVSS 7.5
CVE-2020-13935 [HIGH] Tomcat vulnerabilities
Title: Tomcat vulnerabilities
Summary: Several security issues were fixed in Tomcat.
It was discovered that Tomcat incorrectly validated the payload length in
a WebSocket frame. A remote attacker could possibly use this issue to cause
Tomcat to hang, resulting in a denial of service. (CVE-2020-13935)
It was discovered that Tomcat incorrectly handled HTTP header parsing. In
certain environments where Tomcat is located behind a reverse proxy, a
remote attacker could possibly use this issue to perform HTTP Reqest
Smuggling. (CVE-2020-1935)
It was discovered that Tomcat incorrectly handled certain uncommon
PersistenceManager with FileStore configurations. A remote attacker could
possibly use this issue to execute arbitrary code. (CVE-2020-9484)
Instructions: In general, a standard system
Red Hat
tomcat: multiple requests with invalid payload length in a WebSocket frame could lead to DoS
vendor_redhat·2020-07-15·CVSS 7.5
CVE-2020-13935 [HIGH] CWE-400 tomcat: multiple requests with invalid payload length in a WebSocket frame could lead to DoS
tomcat: multiple requests with invalid payload length in a WebSocket frame could lead to DoS
The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid payload lengths could trigger an infinite loop. Multiple requests with invalid payload lengths could lead to a denial of service.
A flaw was found in Apache Tomcat, where the payload length in a WebSocket frame was not correctly validated. Invalid payload lengths could trigger an infinite loop. Multiple requests with invalid payload lengths could lead to a denial of service. The highest threat from this vulnerability is to system availability.
Statement: Red Hat Certificate System 10.0 as well as Red Hat Enterprise Linux 8
Debian
CVE-2020-13935: tomcat9 - The payload length in a WebSocket frame was not correctly validated in Apache To...
vendor_debian·2020·CVSS 7.5
CVE-2020-13935 [HIGH] CVE-2020-13935: tomcat9 - The payload length in a WebSocket frame was not correctly validated in Apache To...
The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid payload lengths could trigger an infinite loop. Multiple requests with invalid payload lengths could lead to a denial of service.
Scope: local
bookworm: resolved (fixed in 9.0.37-1)
bullseye: resolved (fixed in 9.0.37-1)
forky: resolved (fixed in 9.0.37-1)
sid: resolved (fixed in 9.0.37-1)
trixie: resolved (fixed in 9.0.37-1)
Apache
Apache tomcat: CVE-2020-13935
vendor_apache·CVSS 7.5
CVE-2020-13935 [HIGH] Apache tomcat: CVE-2020-13935
Apache tomcat: CVE-2020-13935
The payload length in a WebSocket frame was not correctly validated. Invalid payload lengths could trigger an infinite loop. Multiple requests with invalid payload lengths could lead to a denial of service. This was fixed with commit 12d71567 . This issue was reported publicly via the Apache Bugzilla instance on 28 June 2020 and included references to high CPU but no specific reference to denial of service. The associated DoS risks were identified by the Apache Tomcat Security Team the same day. The issue was made public on 14 July 2020. Affects: 8.5.0 to 8.5.56 Moderate: HTTP/2 DoS
Severity: high
GHSA
GHSA-8793-frgg-7jvv: A flaw was found in JBossWeb in versions before 7
ghsa_unreviewed·2022-05-24·CVSS 7.5
CVE-2020-14384 [HIGH] GHSA-8793-frgg-7jvv: A flaw was found in JBossWeb in versions before 7
A flaw was found in JBossWeb in versions before 7.5.31.Final-redhat-3. The fix for CVE-2020-13935 was incomplete in JBossWeb, leaving it vulnerable to a denial of service attack when sending multiple requests with invalid payload length in a WebSocket frame. The highest threat from this vulnerability is to system availability.
GHSA
Infinite Loop in Apache Tomcat
ghsa·2022-02-08
CVE-2020-13935 [HIGH] CWE-835 Infinite Loop in Apache Tomcat
Infinite Loop in Apache Tomcat
The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid payload lengths could trigger an infinite loop. Multiple requests with invalid payload lengths could lead to a denial of service.
OSV
Infinite Loop in Apache Tomcat
osv·2022-02-08
CVE-2020-13935 [HIGH] Infinite Loop in Apache Tomcat
Infinite Loop in Apache Tomcat
The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid payload lengths could trigger an infinite loop. Multiple requests with invalid payload lengths could lead to a denial of service.
OSV
tomcat9 vulnerabilities
osv·2020-10-21·CVSS 7.5
CVE-2020-11996 [HIGH] tomcat9 vulnerabilities
tomcat9 vulnerabilities
It was discovered that Tomcat did not properly manage HTTP/2 streams. An
attacker could possibly use this to cause Tomcat to consume resources,
resulting in a denial of service. (CVE-2020-11996)
It was discovered that Tomcat did not properly release the HTTP/1.1
processor after the upgrade to HTTP/2. An attacker could possibly use this
to generate an OutOfMemoryException, resulting in a denial of service.
(CVE-2020-13934)
It was discovered that Tomcat did not properly validate the payload length
in a WebSocket frame. An attacker could possibly use this to trigger an
infinite loop, resulting in a denial of service. (CVE-2020-13935)
It was discovered that Tomcat did not properly deserialize untrusted data.
An attacker could possibly use this issue to execute arbit
OSV
tomcat8 vulnerabilities
osv·2020-08-04·CVSS 7.5
CVE-2020-13935 [HIGH] tomcat8 vulnerabilities
tomcat8 vulnerabilities
It was discovered that Tomcat incorrectly validated the payload length in
a WebSocket frame. A remote attacker could possibly use this issue to cause
Tomcat to hang, resulting in a denial of service. (CVE-2020-13935)
It was discovered that Tomcat incorrectly handled HTTP header parsing. In
certain environments where Tomcat is located behind a reverse proxy, a
remote attacker could possibly use this issue to perform HTTP Reqest
Smuggling. (CVE-2020-1935)
It was discovered that Tomcat incorrectly handled certain uncommon
PersistenceManager with FileStore configurations. A remote attacker could
possibly use this issue to execute arbitrary code. (CVE-2020-9484)
OSV
CVE-2020-13935: The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10
osv·2020-07-14·CVSS 7.5
CVE-2020-13935 [HIGH] CVE-2020-13935: The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10
The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid payload lengths could trigger an infinite loop. Multiple requests with invalid payload lengths could lead to a denial of service.
No detection rules found.
Nuclei
Apache Tomcat WebSocket Frame Payload Length Validation Denial of Service
nuclei·CVSS 7.5
CVE-2020-13935 [HIGH] Apache Tomcat WebSocket Frame Payload Length Validation Denial of Service
Apache Tomcat WebSocket Frame Payload Length Validation Denial of Service
Apache Tomcat versions 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56, and 7.0.27 to 7.0.104 contain a vulnerability in the WebSocket module where the payload length of WebSocket frames is not correctly validated. This can lead to an infinite loop when processing frames with invalid payload lengths. Attackers can exploit this flaw by sending multiple malicious requests, resulting in a denial of service (DoS) on the affected Tomcat instance.
Template:
id: CVE-2020-13935
info:
name: Apache Tomcat WebSocket Frame Payload Length Validation Denial of Service
author: sttlr
severity: high
description: |
Apache Tomcat versions 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56, and 7.0.27 to 7.0.104
Bugzilla
CVE-2020-14384 jbossweb: Incomplete fix of CVE-2020-13935 for WebSocket in JBossWeb could lead to DoS
bugzilla·2020-09-02·CVSS 7.5
CVE-2020-14384 [HIGH] CVE-2020-14384 jbossweb: Incomplete fix of CVE-2020-13935 for WebSocket in JBossWeb could lead to DoS
CVE-2020-14384 jbossweb: Incomplete fix of CVE-2020-13935 for WebSocket in JBossWeb could lead to DoS
The fix for CVE-2020-13935 was incomplete in JBossWeb, leaving it vulnerable to the DoS attack when sending multiple requests with invalid payload length in a WebSocket frame.
Discussion:
Mitigation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
---
This issue has been addressed in the following products:
Red Hat JBoss Enterprise Application Platform
Via RHSA-2020:3731 https://access.redhat.com/errata/RHSA-2020:3731
---
This issue has been addressed in the following products:
Red Hat JBoss Ente
Bugzilla
CVE-2020-13935 tomcat: multiple requests with invalid payload length in a WebSocket frame could lead to DoS [fedora-all]
bugzilla·2020-08-10·CVSS 7.5
CVE-2020-13935 [HIGH] CVE-2020-13935 tomcat: multiple requests with invalid payload length in a WebSocket frame could lead to DoS [fedora-all]
CVE-2020-13935 tomcat: multiple requests with invalid payload length in a WebSocket frame could lead to DoS [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: thi
Bugzilla
CVE-2020-13935 tomcat: multiple requests with invalid payload length in a WebSocket frame could lead to DoS
bugzilla·2020-07-15·CVSS 7.5
CVE-2020-13935 [HIGH] CVE-2020-13935 tomcat: multiple requests with invalid payload length in a WebSocket frame could lead to DoS
CVE-2020-13935 tomcat: multiple requests with invalid payload length in a WebSocket frame could lead to DoS
A flaw was found in the Apache Tomcat, where the payload length in a WebSocket frame was not correctly validated. Invalid payload lengths could trigger an infinite loop. Multiple requests with invalid payload lengths could lead to a denial of service.
It affects the version of Apache Tomcat 10.0.0-M1 to 10.0.0-M6, Apache Tomcat 9.0.0.M1 to 9.0.36, Apache Tomcat 8.5.0 to 8.5.56, and Apache Tomcat 7.0.27 to 7.0.104.
Upstream commits:
Tomcat 10.0: https://github.com/apache/tomcat/commit/1c1c77b0efb667cea80b532440b44cea1dc427c3
Tomcat 9.0: https://github.com/apache/tomcat/commit/40fa74c74822711ab878079d0a69f7357926723d
Tomcat 8.5: https://github.com/apache/tomcat/commit/12d715676038e
2020-09-09
Published