Oval Definition:oval:com.ubuntu.bionic:def:2019100720000000
Revision Date:2019-06-21Version:1
Title:CVE-2019-10072 on Ubuntu 18.04 LTS (bionic) - medium.
Description:The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write in Apache Tomcat versions 9.0.0.M1 to 9.0.19 and 8.5.0 to 8.5.40 . By not sending WINDOW_UPDATE messages for the connection window (stream 0) clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.
Family:unixClass:vulnerability
Status:Reference(s):CVE-2019-10072
Platform(s):Ubuntu 18.04 LTS
Product(s):
Definition Synopsis
  • Ubuntu 18.04 LTS (bionic) is installed.
  • AND Package Information
  • tomcat8 package in bionic was vulnerable but has been fixed (note: '8.5.39-1ubuntu1~18.04.3').
  • OR tomcat9 package in bionic was vulnerable but has been fixed (note: '9.0.16-3ubuntu0.18.04.1').
    • BACK