[
https://issues.apache.org/jira/browse/OFBIZ-11848?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17151036#comment-17151036 ]
ASF subversion and git services commented on OFBIZ-11848:
---------------------------------------------------------
Commit accca2d388300a363c3ff49f1c52c4c9da3731b4 in ofbiz-framework's branch refs/heads/release17.12 from Michael Brohl
[
https://gitbox.apache.org/repos/asf?p=ofbiz-framework.git;h=accca2d ]
Fixed: Added missing AJP connector property introduced for Tomcat 9.0.31
(OFBIZ-11848)
> Upgrade Tomcat from 9.0.34 to 9.0.36 (CVE-2020-11996)
> -----------------------------------------------------
>
> Key: OFBIZ-11848
> URL:
https://issues.apache.org/jira/browse/OFBIZ-11848> Project: OFBiz
> Issue Type: Bug
> Components: framework
> Affects Versions: 18.12.01, 17.12.03, Trunk
> Reporter: Michael Brohl
> Assignee: Michael Brohl
> Priority: Major
> Fix For: 18.12.01, Release Branch 17.12, Upcoming Branch
>
>
> CVE-2020-11996 Apache Tomcat HTTP/2 Denial of Service
> Severity: Important
> Vendor: The Apache Software Foundation
> Versions Affected:
> Apache Tomcat 10.0.0-M1 to 10.0.0-M5
> Apache Tomcat 9.0.0.M1 to 9.0.35
> Apache Tomcat 8.5.0 to 8.5.55
> Description:
> A specially crafted sequence of HTTP/2 requests could trigger high CPU
> usage for several seconds. If a sufficient number of such requests were
> made on concurrent HTTP/2 connections, the server could become unresponsive.
> Mitigation:
> - Upgrade to Apache Tomcat 10.0.0-M6 or later
> - Upgrade to Apache Tomcat 9.0.36 or later
> - Upgrade to Apache Tomcat 8.5.56 or later
> Credit:
> This issue was reported publicly via the Apache Tomcat Users mailing
> list without reference to the potential for DoS. The DoS risks were
> identified by the Apache Tomcat Security Team.
> References:
> [1]
http://tomcat.apache.org/security-10.html> [2]
http://tomcat.apache.org/security-9.html> [3]
http://tomcat.apache.org/security-8.html--
This message was sent by Atlassian Jira
(v8.3.4#803005)
Locked
