Security update for tomcat SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2020:1051-1 Final 1 1 2020-07-23T18:21:33Z current 2020-07-23T18:21:33Z 2020-07-23T18:21:33Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for tomcat This update for tomcat fixes the following issues: Tomcat was updated to 9.0.36 See changelog at - CVE-2020-11996: Fixed an issue which by sending a specially crafted sequence of HTTP/2 requests could have triggered high CPU usage for several seconds making potentially the server unresponsive (bsc#1173389). This update was imported from the SUSE:SLE-15-SP1:Update update project. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-2020-1051 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/opensuse-security-announce/2020-07/msg00064.html E-Mail link for openSUSE-SU-2020:1051-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1173389 SUSE Bug 1173389 https://www.suse.com/security/cve/CVE-2020-11996/ SUSE CVE CVE-2020-11996 page openSUSE Leap 15.1 tomcat-9.0.36-lp151.3.24.1 tomcat-admin-webapps-9.0.36-lp151.3.24.1 tomcat-docs-webapp-9.0.36-lp151.3.24.1 tomcat-el-3_0-api-9.0.36-lp151.3.24.1 tomcat-embed-9.0.36-lp151.3.24.1 tomcat-javadoc-9.0.36-lp151.3.24.1 tomcat-jsp-2_3-api-9.0.36-lp151.3.24.1 tomcat-jsvc-9.0.36-lp151.3.24.1 tomcat-lib-9.0.36-lp151.3.24.1 tomcat-servlet-4_0-api-9.0.36-lp151.3.24.1 tomcat-webapps-9.0.36-lp151.3.24.1 tomcat-9.0.36-lp151.3.24.1 as a component of openSUSE Leap 15.1 tomcat-admin-webapps-9.0.36-lp151.3.24.1 as a component of openSUSE Leap 15.1 tomcat-docs-webapp-9.0.36-lp151.3.24.1 as a component of openSUSE Leap 15.1 tomcat-el-3_0-api-9.0.36-lp151.3.24.1 as a component of openSUSE Leap 15.1 tomcat-embed-9.0.36-lp151.3.24.1 as a component of openSUSE Leap 15.1 tomcat-javadoc-9.0.36-lp151.3.24.1 as a component of openSUSE Leap 15.1 tomcat-jsp-2_3-api-9.0.36-lp151.3.24.1 as a component of openSUSE Leap 15.1 tomcat-jsvc-9.0.36-lp151.3.24.1 as a component of openSUSE Leap 15.1 tomcat-lib-9.0.36-lp151.3.24.1 as a component of openSUSE Leap 15.1 tomcat-servlet-4_0-api-9.0.36-lp151.3.24.1 as a component of openSUSE Leap 15.1 tomcat-webapps-9.0.36-lp151.3.24.1 as a component of openSUSE Leap 15.1 A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU usage for several seconds. If a sufficient number of such requests were made on concurrent HTTP/2 connections, the server could become unresponsive. CVE-2020-11996 openSUSE Leap 15.1:tomcat-9.0.36-lp151.3.24.1 openSUSE Leap 15.1:tomcat-admin-webapps-9.0.36-lp151.3.24.1 openSUSE Leap 15.1:tomcat-docs-webapp-9.0.36-lp151.3.24.1 openSUSE Leap 15.1:tomcat-el-3_0-api-9.0.36-lp151.3.24.1 openSUSE Leap 15.1:tomcat-embed-9.0.36-lp151.3.24.1 openSUSE Leap 15.1:tomcat-javadoc-9.0.36-lp151.3.24.1 openSUSE Leap 15.1:tomcat-jsp-2_3-api-9.0.36-lp151.3.24.1 openSUSE Leap 15.1:tomcat-jsvc-9.0.36-lp151.3.24.1 openSUSE Leap 15.1:tomcat-lib-9.0.36-lp151.3.24.1 openSUSE Leap 15.1:tomcat-servlet-4_0-api-9.0.36-lp151.3.24.1 openSUSE Leap 15.1:tomcat-webapps-9.0.36-lp151.3.24.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/opensuse-security-announce/2020-07/msg00064.html https://www.suse.com/security/cve/CVE-2020-11996.html CVE-2020-11996 https://bugzilla.suse.com/1173389 SUSE Bug 1173389 https://bugzilla.suse.com/1201081 SUSE Bug 1201081