CVE:CVE-2020-17527
CNNVD:CNNVD-202012-065
Apache Tomcat是美国阿帕奇（Apache）基金会的一款轻量级Web应用服务器。该程序实现了对Servlet和JavaServer Page（JSP）的支持。
Apache Tomcat 存在信息泄露漏洞，该漏洞源于可以重用HTTP 2连接上接收到的前一个流的HTTP请求头值，用于与后续流相关联的请求。虽然这很可能会导致错误和HTTP 2连接的关闭，但信息可能会在请求之间泄漏。以下产品及版本受到影响：10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39 and 8.5.0 to 8.5.59。
solution:Upgrade apache tomcat to a higher version than 8.5.59,9.0.35,9.0.0:milestone10,9.0.0:milestone11,9.0.0:milestone12,9.0.0:milestone13,9.0.0:milestone14,9.0.0:milestone15,9.0.0:milestone16,9.0.0:milestone17,9.0.0:milestone18,9.0.0:milestone19,9.0.0:milestone20,9.0.0:milestone21,9.0.0:milestone22,9.0.0:milestone23,9.0.0:milestone24,9.0.0:milestone25,9.0.0:milestone26,9.0.0:milestone27,9.0.0:milestone5,9.0.0:milestone6,9.0.0:milestone7,9.0.0:milestone8,9.0.0:milestone9,9.0.35-3.39.1,9.0.35-3.57.3,9.0.36,9.0.37,9.0.38,9.0.39,10.0.0:milestone1,10.0.0:milestone2,10.0.0:milestone3,10.0.0:milestone4,10.0.0:milestone5,10.0.0:milestone6,10.0.0:milestone7,10.0.0:milestone8,10.0.0:milestone9,and avoid the version [8.5.1,8.5.59],[9.0.1,9.0.35],9.0.0:milestone10,9.0.0:milestone11,9.0.0:milestone12,9.0.0:milestone13,9.0.0:milestone14,9.0.0:milestone15,9.0.0:milestone16,9.0.0:milestone17,9.0.0:milestone18,9.0.0:milestone19,9.0.0:milestone20,9.0.0:milestone21,9.0.0:milestone22,9.0.0:milestone23,9.0.0:milestone24,9.0.0:milestone25,9.0.0:milestone26,9.0.0:milestone27,9.0.0:milestone5,9.0.0:milestone6,9.0.0:milestone7,9.0.0:milestone8,9.0.0:milestone9,9.0.35-3.39.1,9.0.35-3.57.3,9.0.36,9.0.37,9.0.38,9.0.39,10.0.0:milestone1,10.0.0:milestone2,10.0.0:milestone3,10.0.0:milestone4,10.0.0:milestone5,10.0.0:milestone6,10.0.0:milestone7,10.0.0:milestone8,10.0.0:milestone9; Upgrade netapp element_plug-in to a higher version than -; Upgrade netapp oncommand_system_manager to a higher version than 3.1.3,and avoid the version [3.0.0,3.1.3]; Upgrade debian debian_linux to a higher version than 9.0,10.0,and avoid the version 9.0,10.0; Upgrade oracle blockchain_platform to a higher version than 21.1.2,and avoid the version (,21.1.2); Upgrade oracle communications_cloud_native_core_binding_support_function to a higher version than 1.10.0,and avoid the version 1.10.0; Upgrade oracle communications_cloud_native_core_policy to a higher version than 1.14.0,and avoid the version 1.14.0; Upgrade oracle communications_instant_messaging_server to a higher version than 10.0.1.5.0,and avoid the version 10.0.1.5.0; Upgrade oracle instantis_enterprisetrack to a higher version than 17.1,17.2,17.3,and avoid the version 17.1,17.2,17.3; Upgrade oracle mysql_enterprise_monitor to a higher version than 8.0.23,and avoid the version (,8.0.23); Upgrade oracle sd-wan_edge to a higher version than 9.0,and avoid the version 9.0; Upgrade oracle workload_manager to a higher version than 18c,19c,and avoid the version 18c,19c