svn commit: r542927 - head/security/vuxml
Jochen Neumeister
joneum at FreeBSD.org
Thu Jul 23 11:54:54 UTC 2020
Author: joneum
Date: Thu Jul 23 11:54:53 2020
New Revision: 542927
URL: https://svnweb.freebsd.org/changeset/ports/542927
Log:
Add entry for www/tomcat{7,85,9,-devel}
PR: 247975
Sponsored by: Netzkommune GmbH
Modified:
head/security/vuxml/vuln.xml
Modified: head/security/vuxml/vuln.xml
==============================================================================
--- head/security/vuxml/vuln.xml Thu Jul 23 11:14:00 2020 (r542926)
+++ head/security/vuxml/vuln.xml Thu Jul 23 11:54:53 2020 (r542927)
@@ -58,6 +58,51 @@ Notes:
* Do not forget port variants (linux-f10-libxml2, libxml2, etc.)
-->
<vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
+ <vuln vid="6a72eff7-ccd6-11ea-9172-4c72b94353b5">
+ <topic>Apache Tomcat -- Multiple Vulnerabilities</topic>
+ <affects>
+ <package>
+ <name>tomcat7</name>
+ <range><lt>7.0.105</lt></range>
+ </package>
+ <package>
+ <name>tomcat85</name>
+ <range><lt>8.5.57</lt></range>
+ </package>
+ <package>
+ <name>tomcat9</name>
+ <range><lt>9.0.37</lt></range>
+ </package>
+ <package>
+ <name>tomcat-devel</name>
+ <range><lt>10.0.0.M7</lt></range>
+ </package>
+ </affects>
+ <description>
+ <body xmlns="http://www.w3.org/1999/xhtml">
+ <p>The Apache Software Foundation reports:</p>
+ <p>An h2c direct connection did not release the HTTP/1.1 processor after
+ the upgrade to HTTP/2. If a sufficient number of such requests were
+ made, an OutOfMemoryException could occur leading to a denial of service.</p>
+ <p>The payload length in a WebSocket frame was not correctly validated.
+ Invalid payload lengths could trigger an infinite loop. Multiple
+ requests with invalid payload lengths could lead to a denial of service.</p>
+ </body>
+ </description>
+ <references>
+ <url>https://tomcat.apache.org/security-7.html</url>
+ <url>https://tomcat.apache.org/security-8.html</url>
+ <url>https://tomcat.apache.org/security-9.html</url>
+ <url>https://tomcat.apache.org/security-10.html</url>
+ <cvename>CVE-2020-13934</cvename>
+ <cvename>CVE-2020-13935</cvename>
+ </references>
+ <dates>
+ <discovery>2020-07-05</discovery>
+ <entry>2020-07-23</entry>
+ </dates>
+ </vuln>
+
<vuln vid="a9eeb3a3-ca5e-11ea-930b-080027846a02">
<topic>Python -- multiple vulnerabilities</topic>
<affects>
More information about the svn-ports-all
mailing list