CVE编号
CVE-2019-0199利用情况
暂无补丁情况
官方补丁披露时间
2019-04-11漏洞描述
Tomcat是Apache软件基金会中的一个重要项目，性能稳定且免费，是目前较为流行的Web应用服务器。Apache Tomcat HTTP/2在实现中拒绝服务漏洞，该漏洞是由于应用服务允许接收大量的配置流量，并且客户端在没有读写请求的情况下可以长时间保持连接而导致。如果来自客户端的连接请求过多，最终可导致服务端线程耗尽，攻击者成功利用此漏洞可实现对目标的拒绝服务攻击。解决建议
建议您更新当前系统或软件至最新版，完成漏洞的修复。
参考链接 |
|
|---|---|
| http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00090.html | |
| http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00013.html | |
| http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00054.html | |
| http://www.securityfocus.com/bid/107674 | |
| https://access.redhat.com/errata/RHSA-2019:3929 | |
| https://access.redhat.com/errata/RHSA-2019:3931 | |
| https://lists.apache.org/thread.html/158ab719cf60448ddbb074798f09152fdb572fc8... | |
| https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba... | |
| https://lists.apache.org/thread.html/4c438fa4c78cb1ce8979077f668ab7145baf83e7... | |
| https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba14... | |
| https://lists.apache.org/thread.html/7bb193bc68b28d21ff1c726fd38bea164deb6333... | |
| https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ff... | |
| https://lists.apache.org/thread.html/9fe25f98bac6d66f8a663a15c37a98bc2d8f8bbe... | |
| https://lists.apache.org/thread.html/a7a201bd23e67fd3326c9b22b814dd0537d3270b... | |
| https://lists.apache.org/thread.html/ac0185ce240a711b542a55bccf9349ab0c2f343d... | |
| https://lists.apache.org/thread.html/cf4eb2bd2083cebb3602a293c653f9a7faa96c86... | |
| https://lists.apache.org/thread.html/dddb3590bac28fbe89f69f5ccbe26283d014ddc6... | |
| https://lists.apache.org/thread.html/df1a2c1b87c8a6c500ecdbbaf134c7f1491c8d79... | |
| https://lists.apache.org/thread.html/e1b0b273b6e8ddcc72c9023bc2394b1276fc7266... | |
| https://lists.apache.org/thread.html/e56886e1bac9319ecce81b3612dd7a1a43174a3a... | |
| https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df... | |
| https://lists.apache.org/thread.html/e87733036e8c84ea648cdcdca3098f3c8a897e26... | |
| https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fff... | |
| https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5... | |
| https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f67... | |
| https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab... | |
| https://lists.fedoraproject.org/archives/list/[email protected]... | |
| https://lists.fedoraproject.org/archives/list/[email protected]... | |
| https://seclists.org/bugtraq/2019/Dec/43 | |
| https://security.netapp.com/advisory/ntap-20190419-0001/ | |
| https://support.f5.com/csp/article/K17321505 | |
| https://www.debian.org/security/2019/dsa-4596 | |
| https://www.oracle.com/security-alerts/cpuapr2020.html | |
| https://www.oracle.com/security-alerts/cpujan2020.html | |
| https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html |
受影响软件情况
| # | 类型 | 厂商 | 产品 | 版本 | 影响面 | ||||
| 1 | |||||||||
|---|---|---|---|---|---|---|---|---|---|
| 运行在以下环境 | |||||||||
| 应用 | apache | tomcat | * |
From (including) 8.5.0 |
Up to (including) 8.5.37 |
||||
| 运行在以下环境 | |||||||||
| 应用 | apache | tomcat | * |
From (including) 9.0.1 |
Up to (including) 9.0.14 |
||||
| 运行在以下环境 | |||||||||
| 应用 | apache | tomcat | 9.0.0 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | amazon linux_AMI | tomcat8 | * |
Up to (excluding) 8.5.40-1.79.amzn1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | amazon_AMI | tomcat8 | * |
Up to (excluding) 3.1-api-8.5.40-1.79.amzn1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | debian_9 | tomcat8 | * |
Up to (excluding) 8.5.50-0+deb9u1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | fedora_29 | tomcat8 | * |
Up to (excluding) 9.0.21-1.fc29 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | fedora_30 | tomcat8 | * |
Up to (excluding) 9.0.21-1.fc30 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | opensuse_Leap_15.0 | tomcat8 | * |
Up to (excluding) 9.0.20-lp150.2.19.1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | opensuse_Leap_15.1 | tomcat8 | * |
Up to (excluding) 9.0.21-lp151.3.3.1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | sles_12 | tomcat | * |
Up to (excluding) 9.0.21-3.13 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | sles_12_SP4 | tomcat8 | * |
Up to (excluding) 9.0.21-3.13.2 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | suse_12_SP4 | tomcat8 | * |
Up to (excluding) 9.0.21-3.13.2 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | ubuntu_18.04 | tomcat8 | * |
Up to (excluding) 8.5.39-1ubuntu1~18.04.1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | ubuntu_18.04_lts | tomcat8 | * |
Up to (excluding) 8.5.39-1ubuntu1~18.04.1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | ubuntu_18.10 | tomcat8 | * |
Up to (excluding) 8.5.39-1ubuntu1~18.10 |
|||||
- 攻击路径 远程
- 攻击复杂度 复杂
- 权限要求 无需权限
- 影响范围 有限影响
- EXP成熟度 未验证
- 补丁情况 官方补丁
- 数据保密性 无影响
- 数据完整性 无影响
- 服务器危害 无影响
- 全网数量 100
还没有评论，来说两句吧...