CVE-2020-13935

tomcat: multiple requests with invalid payload length in a WebSocket frame could lead to DoS

Severity Score

7.5

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid payload lengths could trigger an infinite loop. Multiple requests with invalid payload lengths could lead to a denial of service.

La longitud de la carga útil en una trama de WebSocket no fue comprobada correctamente en Apache Tomcat versiones 10.0.0-M1 hasta 10.0.0-M6, versiones 9.0.0.M1 hasta 9.0.36, versiones 8.5.0 hasta 8.5.56 y versiones 7.0.27 hasta 7.0. 104. Las longitudes de carga útil no válidas podrían desencadenar un bucle infinito. Múltiples peticiones con longitudes de carga no válidas podrían conllevar a una denegación de servicio

A flaw was found in Apache Tomcat, where the payload length in a WebSocket frame was not correctly validated. Invalid payload lengths could trigger an infinite loop. Multiple requests with invalid payload lengths could lead to a denial of service. The highest threat from this vulnerability is to system availability.

*Credits: N/A

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Attack Vector

Network

Attack Complexity

Low

Authentication

None

Confidentiality

None

Integrity

None

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2020-06-08 CVE Reserved
2020-07-14 CVE Published
2020-11-02 First Exploit
2024-06-04 EPSS Updated
2024-08-04 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-400: Uncontrolled Resource Consumption
CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')

CAPEC

References (21)

URL	Tag	Source
https://kc.mcafee.com/corporate/index?page=content&id=SB10332	Third Party Advisory
https://lists.apache.org/thread.html/r4e5d3c09f4dd2923191e972408b40fb8b42dbff0bc7904d44b651e50%40%3Cusers.tomcat.apache.org%3E	Mailing List
https://lists.debian.org/debian-lts-announce/2020/07/msg00017.html	Mailing List
https://security.netapp.com/advisory/ntap-20200724-0003	Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2021.html	Not Applicable

URL	Date	SRC
https://github.com/RedTeamPentesting/CVE-2020-13935	2020-11-02
https://github.com/aabbcc19191/CVE-2020-13935	2022-06-03

URL	Date	SRC
https://www.oracle.com//security-alerts/cpujul2021.html	2023-11-07
https://www.oracle.com/security-alerts/cpuApr2021.html	2023-11-07
https://www.oracle.com/security-alerts/cpuapr2022.html	2023-11-07
https://www.oracle.com/security-alerts/cpujan2021.html	2023-11-07
https://www.oracle.com/security-alerts/cpujan2022.html	2023-11-07
https://www.oracle.com/security-alerts/cpuoct2020.html	2023-11-07

URL	Date	SRC
http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00084.html	2023-11-07
http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00088.html	2023-11-07
https://lists.apache.org/thread.html/rd48c72bd3255bda87564d4da3791517c074d94f8a701f93b85752651%40%3Cannounce.tomcat.apache.org%3E	2023-11-07
https://usn.ubuntu.com/4448-1	2023-11-07
https://usn.ubuntu.com/4596-1	2023-11-07
https://www.debian.org/security/2020/dsa-4727	2023-11-07
https://access.redhat.com/security/cve/CVE-2020-13935	2022-06-30
https://bugzilla.redhat.com/show_bug.cgi?id=1857024	2022-06-30

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				>= 7.0.27 <= 7.0.104 Search vendor "Apache" for product "Tomcat" and version " >= 7.0.27 <= 7.0.104"		-		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				>= 8.5.0 <= 8.5.56 Search vendor "Apache" for product "Tomcat" and version " >= 8.5.0 <= 8.5.56"		-		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				>= 9.0.1 <= 9.0.36 Search vendor "Apache" for product "Tomcat" and version " >= 9.0.1 <= 9.0.36"		-		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				9.0.0 Search vendor "Apache" for product "Tomcat" and version "9.0.0"		milestone1		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				9.0.0 Search vendor "Apache" for product "Tomcat" and version "9.0.0"		milestone10		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				9.0.0 Search vendor "Apache" for product "Tomcat" and version "9.0.0"		milestone11		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				9.0.0 Search vendor "Apache" for product "Tomcat" and version "9.0.0"		milestone12		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				9.0.0 Search vendor "Apache" for product "Tomcat" and version "9.0.0"		milestone13		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				9.0.0 Search vendor "Apache" for product "Tomcat" and version "9.0.0"		milestone14		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				9.0.0 Search vendor "Apache" for product "Tomcat" and version "9.0.0"		milestone15		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				9.0.0 Search vendor "Apache" for product "Tomcat" and version "9.0.0"		milestone16		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				9.0.0 Search vendor "Apache" for product "Tomcat" and version "9.0.0"		milestone17		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				9.0.0 Search vendor "Apache" for product "Tomcat" and version "9.0.0"		milestone18		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				9.0.0 Search vendor "Apache" for product "Tomcat" and version "9.0.0"		milestone19		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				9.0.0 Search vendor "Apache" for product "Tomcat" and version "9.0.0"		milestone2		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				9.0.0 Search vendor "Apache" for product "Tomcat" and version "9.0.0"		milestone20		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				9.0.0 Search vendor "Apache" for product "Tomcat" and version "9.0.0"		milestone21		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				9.0.0 Search vendor "Apache" for product "Tomcat" and version "9.0.0"		milestone22		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				9.0.0 Search vendor "Apache" for product "Tomcat" and version "9.0.0"		milestone23		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				9.0.0 Search vendor "Apache" for product "Tomcat" and version "9.0.0"		milestone24		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				9.0.0 Search vendor "Apache" for product "Tomcat" and version "9.0.0"		milestone25		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				9.0.0 Search vendor "Apache" for product "Tomcat" and version "9.0.0"		milestone26		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				9.0.0 Search vendor "Apache" for product "Tomcat" and version "9.0.0"		milestone27		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				9.0.0 Search vendor "Apache" for product "Tomcat" and version "9.0.0"		milestone3		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				9.0.0 Search vendor "Apache" for product "Tomcat" and version "9.0.0"		milestone4		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				9.0.0 Search vendor "Apache" for product "Tomcat" and version "9.0.0"		milestone5		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				9.0.0 Search vendor "Apache" for product "Tomcat" and version "9.0.0"		milestone6		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				9.0.0 Search vendor "Apache" for product "Tomcat" and version "9.0.0"		milestone7		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				9.0.0 Search vendor "Apache" for product "Tomcat" and version "9.0.0"		milestone8		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				9.0.0 Search vendor "Apache" for product "Tomcat" and version "9.0.0"		milestone9		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				10.0.0 Search vendor "Apache" for product "Tomcat" and version "10.0.0"		milestone1		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				10.0.0 Search vendor "Apache" for product "Tomcat" and version "10.0.0"		milestone2		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				10.0.0 Search vendor "Apache" for product "Tomcat" and version "10.0.0"		milestone3		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				10.0.0 Search vendor "Apache" for product "Tomcat" and version "10.0.0"		milestone4		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				10.0.0 Search vendor "Apache" for product "Tomcat" and version "10.0.0"		milestone5		Affected
Apache Search vendor "Apache"		Tomcat Search vendor "Apache" for product "Tomcat"				10.0.0 Search vendor "Apache" for product "Tomcat" and version "10.0.0"		milestone6		Affected
Debian Search vendor "Debian"		Debian Linux Search vendor "Debian" for product "Debian Linux"				9.0 Search vendor "Debian" for product "Debian Linux" and version "9.0"		-		Affected
Debian Search vendor "Debian"		Debian Linux Search vendor "Debian" for product "Debian Linux"				10.0 Search vendor "Debian" for product "Debian Linux" and version "10.0"		-		Affected
Netapp Search vendor "Netapp"		Oncommand System Manager Search vendor "Netapp" for product "Oncommand System Manager"				>= 3.0.0 <= 3.1.3 Search vendor "Netapp" for product "Oncommand System Manager" and version " >= 3.0.0 <= 3.1.3"		-		Affected
Opensuse Search vendor "Opensuse"		Leap Search vendor "Opensuse" for product "Leap"				15.1 Search vendor "Opensuse" for product "Leap" and version "15.1"		-		Affected
Opensuse Search vendor "Opensuse"		Leap Search vendor "Opensuse" for product "Leap"				15.2 Search vendor "Opensuse" for product "Leap" and version "15.2"		-		Affected
Canonical Search vendor "Canonical"		Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux"				16.04 Search vendor "Canonical" for product "Ubuntu Linux" and version "16.04"		esm		Affected
Canonical Search vendor "Canonical"		Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux"				20.04 Search vendor "Canonical" for product "Ubuntu Linux" and version "20.04"		lts		Affected
Mcafee Search vendor "Mcafee"		Epolicy Orchestrator Search vendor "Mcafee" for product "Epolicy Orchestrator"				5.9.0 Search vendor "Mcafee" for product "Epolicy Orchestrator" and version "5.9.0"		-		Affected
Mcafee Search vendor "Mcafee"		Epolicy Orchestrator Search vendor "Mcafee" for product "Epolicy Orchestrator"				5.9.1 Search vendor "Mcafee" for product "Epolicy Orchestrator" and version "5.9.1"		-		Affected
Mcafee Search vendor "Mcafee"		Epolicy Orchestrator Search vendor "Mcafee" for product "Epolicy Orchestrator"				5.10.0 Search vendor "Mcafee" for product "Epolicy Orchestrator" and version "5.10.0"		-		Affected
Mcafee Search vendor "Mcafee"		Epolicy Orchestrator Search vendor "Mcafee" for product "Epolicy Orchestrator"				5.10.0 Search vendor "Mcafee" for product "Epolicy Orchestrator" and version "5.10.0"		update_1		Affected
Mcafee Search vendor "Mcafee"		Epolicy Orchestrator Search vendor "Mcafee" for product "Epolicy Orchestrator"				5.10.0 Search vendor "Mcafee" for product "Epolicy Orchestrator" and version "5.10.0"		update_2		Affected
Mcafee Search vendor "Mcafee"		Epolicy Orchestrator Search vendor "Mcafee" for product "Epolicy Orchestrator"				5.10.0 Search vendor "Mcafee" for product "Epolicy Orchestrator" and version "5.10.0"		update_3		Affected
Mcafee Search vendor "Mcafee"		Epolicy Orchestrator Search vendor "Mcafee" for product "Epolicy Orchestrator"				5.10.0 Search vendor "Mcafee" for product "Epolicy Orchestrator" and version "5.10.0"		update_4		Affected
Mcafee Search vendor "Mcafee"		Epolicy Orchestrator Search vendor "Mcafee" for product "Epolicy Orchestrator"				5.10.0 Search vendor "Mcafee" for product "Epolicy Orchestrator" and version "5.10.0"		update_5		Affected
Mcafee Search vendor "Mcafee"		Epolicy Orchestrator Search vendor "Mcafee" for product "Epolicy Orchestrator"				5.10.0 Search vendor "Mcafee" for product "Epolicy Orchestrator" and version "5.10.0"		update_6		Affected
Mcafee Search vendor "Mcafee"		Epolicy Orchestrator Search vendor "Mcafee" for product "Epolicy Orchestrator"				5.10.0 Search vendor "Mcafee" for product "Epolicy Orchestrator" and version "5.10.0"		update_7		Affected
Mcafee Search vendor "Mcafee"		Epolicy Orchestrator Search vendor "Mcafee" for product "Epolicy Orchestrator"				5.10.0 Search vendor "Mcafee" for product "Epolicy Orchestrator" and version "5.10.0"		update_8		Affected
Oracle Search vendor "Oracle"		Agile Engineering Data Management Search vendor "Oracle" for product "Agile Engineering Data Management"				6.2.1.0 Search vendor "Oracle" for product "Agile Engineering Data Management" and version "6.2.1.0"		-		Affected
Oracle Search vendor "Oracle"		Agile Plm Search vendor "Oracle" for product "Agile Plm"				9.3.3 Search vendor "Oracle" for product "Agile Plm" and version "9.3.3"		-		Affected
Oracle Search vendor "Oracle"		Agile Plm Search vendor "Oracle" for product "Agile Plm"				9.3.5 Search vendor "Oracle" for product "Agile Plm" and version "9.3.5"		-		Affected
Oracle Search vendor "Oracle"		Agile Plm Search vendor "Oracle" for product "Agile Plm"				9.3.6 Search vendor "Oracle" for product "Agile Plm" and version "9.3.6"		-		Affected
Oracle Search vendor "Oracle"		Blockchain Platform Search vendor "Oracle" for product "Blockchain Platform"				< 21.1.2 Search vendor "Oracle" for product "Blockchain Platform" and version " < 21.1.2"		-		Affected
Oracle Search vendor "Oracle"		Commerce Guided Search Search vendor "Oracle" for product "Commerce Guided Search"				11.3.2 Search vendor "Oracle" for product "Commerce Guided Search" and version "11.3.2"		-		Affected
Oracle Search vendor "Oracle"		Communications Cloud Native Core Policy Search vendor "Oracle" for product "Communications Cloud Native Core Policy"				1.14.0 Search vendor "Oracle" for product "Communications Cloud Native Core Policy" and version "1.14.0"		-		Affected
Oracle Search vendor "Oracle"		Communications Instant Messaging Server Search vendor "Oracle" for product "Communications Instant Messaging Server"				10.0.1.5.0 Search vendor "Oracle" for product "Communications Instant Messaging Server" and version "10.0.1.5.0"		-		Affected
Oracle Search vendor "Oracle"		Fmw Platform Search vendor "Oracle" for product "Fmw Platform"				12.2.1.3.0 Search vendor "Oracle" for product "Fmw Platform" and version "12.2.1.3.0"		-		Affected
Oracle Search vendor "Oracle"		Fmw Platform Search vendor "Oracle" for product "Fmw Platform"				12.2.1.4.0 Search vendor "Oracle" for product "Fmw Platform" and version "12.2.1.4.0"		-		Affected
Oracle Search vendor "Oracle"		Instantis Enterprisetrack Search vendor "Oracle" for product "Instantis Enterprisetrack"				17.1 Search vendor "Oracle" for product "Instantis Enterprisetrack" and version "17.1"		-		Affected
Oracle Search vendor "Oracle"		Instantis Enterprisetrack Search vendor "Oracle" for product "Instantis Enterprisetrack"				17.2 Search vendor "Oracle" for product "Instantis Enterprisetrack" and version "17.2"		-		Affected
Oracle Search vendor "Oracle"		Instantis Enterprisetrack Search vendor "Oracle" for product "Instantis Enterprisetrack"				17.3 Search vendor "Oracle" for product "Instantis Enterprisetrack" and version "17.3"		-		Affected
Oracle Search vendor "Oracle"		Managed File Transfer Search vendor "Oracle" for product "Managed File Transfer"				12.2.1.3.0 Search vendor "Oracle" for product "Managed File Transfer" and version "12.2.1.3.0"		-		Affected
Oracle Search vendor "Oracle"		Managed File Transfer Search vendor "Oracle" for product "Managed File Transfer"				12.2.1.4.0 Search vendor "Oracle" for product "Managed File Transfer" and version "12.2.1.4.0"		-		Affected
Oracle Search vendor "Oracle"		Mysql Enterprise Monitor Search vendor "Oracle" for product "Mysql Enterprise Monitor"				<= 8.0.21 Search vendor "Oracle" for product "Mysql Enterprise Monitor" and version " <= 8.0.21"		-		Affected
Oracle Search vendor "Oracle"		Siebel Ui Framework Search vendor "Oracle" for product "Siebel Ui Framework"				<= 20.12 Search vendor "Oracle" for product "Siebel Ui Framework" and version " <= 20.12"		-		Affected
Oracle Search vendor "Oracle"		Workload Manager Search vendor "Oracle" for product "Workload Manager"				12.2.0.1 Search vendor "Oracle" for product "Workload Manager" and version "12.2.0.1"		-		Affected
Oracle Search vendor "Oracle"		Workload Manager Search vendor "Oracle" for product "Workload Manager"				18c Search vendor "Oracle" for product "Workload Manager" and version "18c"		-		Affected
Oracle Search vendor "Oracle"		Workload Manager Search vendor "Oracle" for product "Workload Manager"				19c Search vendor "Oracle" for product "Workload Manager" and version "19c"		-		Affected