Vulnerabilities > CVE-2020-13935 - Infinite Loop vulnerability in multiple products

The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid payload lengths could trigger an infinite loop. Multiple requests with invalid payload lengths could lead to a denial of service.

Vulnerable Configurations

Part	Description	Count
Application	Apache Apache Tomcat 9.0.0 Apache Tomcat 10.0.0 Apache Tomcat 9.0.1 Apache Tomcat 9.0.2 Apache Tomcat 9.0.3 Apache Tomcat 9.0.4 Apache Tomcat 9.0.5 Apache Tomcat 9.0.6 Apache Tomcat 9.0.7 Apache Tomcat 9.0.8 Apache Tomcat 9.0.9 Apache Tomcat 9.0.10 Apache Tomcat 9.0.11 Apache Tomcat 9.0.12 Apache Tomcat 9.0.13 Apache Tomcat 9.0.14 Apache Tomcat 9.0.15 Apache Tomcat 9.0.16 Apache Tomcat 9.0.17 Apache Tomcat 9.0.18 Apache Tomcat 9.0.19 Apache Tomcat 9.0.20 Apache Tomcat 9.0.21 Apache Tomcat 9.0.22 Apache Tomcat 9.0.23 Apache Tomcat 9.0.24 Apache Tomcat 9.0.25 Apache Tomcat 9.0.26 Apache Tomcat 9.0.27 Apache Tomcat 9.0.28 Apache Tomcat 9.0.29 Apache Tomcat 9.0.30 Apache Tomcat 9.0.31 Apache Tomcat 9.0.32 Apache Tomcat 9.0.33 Apache Tomcat 9.0.34 Apache Tomcat 9.0.35 Apache Tomcat 9.0.35-3.39.1 Apache Tomcat 9.0.35-3.57.3 Apache Tomcat 9.0.36 Apache Tomcat 7.0.27 Apache Tomcat 7.0.28 Apache Tomcat 7.0.29 Apache Tomcat 7.0.30 Apache Tomcat 7.0.31 Apache Tomcat 7.0.32 Apache Tomcat 7.0.33 Apache Tomcat 7.0.34 Apache Tomcat 7.0.35 Apache Tomcat 7.0.36 Apache Tomcat 7.0.37 Apache Tomcat 7.0.38 Apache Tomcat 7.0.39 Apache Tomcat 7.0.40 Apache Tomcat 7.0.41 Apache Tomcat 7.0.42 Apache Tomcat 7.0.43 Apache Tomcat 7.0.44 Apache Tomcat 7.0.45 Apache Tomcat 7.0.46 Apache Tomcat 7.0.47 Apache Tomcat 7.0.48 Apache Tomcat 7.0.49 Apache Tomcat 7.0.50 Apache Tomcat 7.0.51 Apache Tomcat 7.0.52 Apache Tomcat 7.0.53 Apache Tomcat 7.0.54 Apache Tomcat 7.0.55 Apache Tomcat 7.0.56 Apache Tomcat 7.0.57 Apache Tomcat 7.0.58 Apache Tomcat 7.0.59 Apache Tomcat 7.0.60 Apache Tomcat 7.0.61 Apache Tomcat 7.0.62 Apache Tomcat 7.0.63 Apache Tomcat 7.0.64 Apache Tomcat 7.0.65 Apache Tomcat 7.0.66 Apache Tomcat 7.0.67 Apache Tomcat 7.0.68 Apache Tomcat 7.0.69 Apache Tomcat 7.0.70 Apache Tomcat 7.0.71 Apache Tomcat 7.0.72 Apache Tomcat 7.0.73 Apache Tomcat 7.0.74 Apache Tomcat 7.0.75 Apache Tomcat 7.0.76 Apache Tomcat 7.0.77 Apache Tomcat 7.0.78 Apache Tomcat 7.0.79 Apache Tomcat 7.0.80 Apache Tomcat 7.0.81 Apache Tomcat 7.0.82 Apache Tomcat 7.0.83 Apache Tomcat 7.0.84 Apache Tomcat 7.0.85 Apache Tomcat 7.0.86 Apache Tomcat 7.0.87 Apache Tomcat 7.0.88 Apache Tomcat 7.0.89 Apache Tomcat 7.0.90 Apache Tomcat 7.0.91 Apache Tomcat 7.0.92 Apache Tomcat 7.0.93 Apache Tomcat 7.0.94 Apache Tomcat 7.0.95 Apache Tomcat 7.0.96 Apache Tomcat 7.0.97 Apache Tomcat 7.0.98 Apache Tomcat 7.0.99 Apache Tomcat 7.0.100 Apache Tomcat 7.0.101 Apache Tomcat 7.0.102 Apache Tomcat 7.0.103 Apache Tomcat 7.0.104 Apache Tomcat 8.5.0 Apache Tomcat 8.5.1 Apache Tomcat 8.5.2 Apache Tomcat 8.5.3 Apache Tomcat 8.5.4 Apache Tomcat 8.5.5 Apache Tomcat 8.5.6 Apache Tomcat 8.5.7 Apache Tomcat 8.5.8 Apache Tomcat 8.5.9 Apache Tomcat 8.5.10 Apache Tomcat 8.5.11 Apache Tomcat 8.5.12 Apache Tomcat 8.5.13 Apache Tomcat 8.5.14 Apache Tomcat 8.5.15 Apache Tomcat 8.5.16 Apache Tomcat 8.5.17 Apache Tomcat 8.5.18 Apache Tomcat 8.5.19 Apache Tomcat 8.5.20 Apache Tomcat 8.5.21 Apache Tomcat 8.5.22 Apache Tomcat 8.5.23 Apache Tomcat 8.5.24 Apache Tomcat 8.5.25 Apache Tomcat 8.5.26 Apache Tomcat 8.5.27 Apache Tomcat 8.5.28 Apache Tomcat 8.5.29 Apache Tomcat 8.5.30 Apache Tomcat 8.5.31 Apache Tomcat 8.5.32 Apache Tomcat 8.5.33 Apache Tomcat 8.5.34 Apache Tomcat 8.5.35 Apache Tomcat 8.5.36 Apache Tomcat 8.5.37 Apache Tomcat 8.5.38 Apache Tomcat 8.5.39 Apache Tomcat 8.5.40 Apache Tomcat 8.5.41 Apache Tomcat 8.5.42 Apache Tomcat 8.5.43 Apache Tomcat 8.5.44 Apache Tomcat 8.5.45 Apache Tomcat 8.5.46 Apache Tomcat 8.5.47 Apache Tomcat 8.5.48 Apache Tomcat 8.5.49 Apache Tomcat 8.5.50 Apache Tomcat 8.5.51 Apache Tomcat 8.5.52 Apache Tomcat 8.5.53 Apache Tomcat 8.5.54 Apache Tomcat 8.5.55 Apache Tomcat 8.5.56	206
Application	Netapp Netapp Oncommand System Manager 3.0.0 Netapp Oncommand System Manager 3.1 Netapp Oncommand System Manager 3.1.1 Netapp Oncommand System Manager 3.1.2 Netapp Oncommand System Manager 3.1.3	5
Application	Mcafee Mcafee Epolicy Orchestrator 5.9.0 Mcafee Epolicy Orchestrator 5.9.1 Mcafee Epolicy Orchestrator 5.10.0	11
Application	Oracle Oracle Managed File Transfer 12.2.1.3.0 Oracle Managed File Transfer 12.2.1.4.0 Oracle Instantis Enterprisetrack 17.1 Oracle Instantis Enterprisetrack 17.2 Oracle Instantis Enterprisetrack 17.3 Oracle Agile PLM 9.3.3 Oracle Agile PLM 9.3.5 Oracle Agile PLM 9.3.6 Oracle Workload Manager 18C Oracle Workload Manager 19C Oracle Workload Manager 12.2.0.1 Oracle Agile Engineering Data Management 6.2.1.0 Oracle Siebel UI Framework - Oracle Siebel UI Framework 8.1.1 Oracle Siebel UI Framework 8.2.2 Oracle Siebel UI Framework 16.0 Oracle Siebel UI Framework 16.1 Oracle Siebel UI Framework 17.0 Oracle Siebel UI Framework 18.0 Oracle Siebel UI Framework 18.7 Oracle Siebel UI Framework 18.8 Oracle Siebel UI Framework 18.9 Oracle Siebel UI Framework 18.10 Oracle Siebel UI Framework 18.11 Oracle Siebel UI Framework 19.0 Oracle Siebel UI Framework 19.7 Oracle Siebel UI Framework 19.8 Oracle Siebel UI Framework 19.10 Oracle Siebel UI Framework 20.1 Oracle Siebel UI Framework 20.2 Oracle Siebel UI Framework 20.5 Oracle Siebel UI Framework 20.6 Oracle Siebel UI Framework 20.8 Oracle Siebel UI Framework 20.12 Oracle Mysql Enterprise Monitor - Oracle Mysql Enterprise Monitor 2.3.14 Oracle Mysql Enterprise Monitor 3.0.4 Oracle Mysql Enterprise Monitor 3.0.25 Oracle Mysql Enterprise Monitor 3.1.0 Oracle Mysql Enterprise Monitor 3.1.1 Oracle Mysql Enterprise Monitor 3.1.2 Oracle Mysql Enterprise Monitor 3.1.3 Oracle Mysql Enterprise Monitor 3.1.3.7856 Oracle Mysql Enterprise Monitor 3.1.4 Oracle Mysql Enterprise Monitor 3.1.5 Oracle Mysql Enterprise Monitor 3.1.6 Oracle Mysql Enterprise Monitor 3.1.6.8003 Oracle Mysql Enterprise Monitor 3.1.7 Oracle Mysql Enterprise Monitor 3.2.0 Oracle Mysql Enterprise Monitor 3.2.1 Oracle Mysql Enterprise Monitor 3.2.2 Oracle Mysql Enterprise Monitor 3.2.3 Oracle Mysql Enterprise Monitor 3.2.4 Oracle Mysql Enterprise Monitor 3.2.5 Oracle Mysql Enterprise Monitor 3.2.6 Oracle Mysql Enterprise Monitor 3.2.7 Oracle Mysql Enterprise Monitor 3.2.8 Oracle Mysql Enterprise Monitor 3.2.8.2223 Oracle Mysql Enterprise Monitor 3.2.9 Oracle Mysql Enterprise Monitor 3.2.10 Oracle Mysql Enterprise Monitor 3.2.1182 Oracle Mysql Enterprise Monitor 3.3.0 Oracle Mysql Enterprise Monitor 3.3.1 Oracle Mysql Enterprise Monitor 3.3.2 Oracle Mysql Enterprise Monitor 3.3.2.1162 Oracle Mysql Enterprise Monitor 3.3.3 Oracle Mysql Enterprise Monitor 3.3.4 Oracle Mysql Enterprise Monitor 3.3.4.3247 Oracle Mysql Enterprise Monitor 3.3.5 Oracle Mysql Enterprise Monitor 3.3.6 Oracle Mysql Enterprise Monitor 3.3.6.3293 Oracle Mysql Enterprise Monitor 3.3.7 Oracle Mysql Enterprise Monitor 3.3.8 Oracle Mysql Enterprise Monitor 3.3.9 Oracle Mysql Enterprise Monitor 3.4.0 Oracle Mysql Enterprise Monitor 3.4.1 Oracle Mysql Enterprise Monitor 3.4.2 Oracle Mysql Enterprise Monitor 3.4.2.4181 Oracle Mysql Enterprise Monitor 3.4.3 Oracle Mysql Enterprise Monitor 3.4.4 Oracle Mysql Enterprise Monitor 3.4.4.4226 Oracle Mysql Enterprise Monitor 3.4.5 Oracle Mysql Enterprise Monitor 3.4.6 Oracle Mysql Enterprise Monitor 3.4.7 Oracle Mysql Enterprise Monitor 3.4.7.4297 Oracle Mysql Enterprise Monitor 3.4.8 Oracle Mysql Enterprise Monitor 3.4.9 Oracle Mysql Enterprise Monitor 3.4.9.4237 Oracle Mysql Enterprise Monitor 3.4.10 Oracle Mysql Enterprise Monitor 4.0.0 Oracle Mysql Enterprise Monitor 4.0.0.5135 Oracle Mysql Enterprise Monitor 4.0.1 Oracle Mysql Enterprise Monitor 4.0.2 Oracle Mysql Enterprise Monitor 4.0.3 Oracle Mysql Enterprise Monitor 4.0.4 Oracle Mysql Enterprise Monitor 4.0.4.5235 Oracle Mysql Enterprise Monitor 4.0.5 Oracle Mysql Enterprise Monitor 4.0.6 Oracle Mysql Enterprise Monitor 4.0.6.5281 Oracle Mysql Enterprise Monitor 4.0.7 Oracle Mysql Enterprise Monitor 4.0.8 Oracle Mysql Enterprise Monitor 4.0.11.5331 Oracle Mysql Enterprise Monitor 4.0.12 Oracle Mysql Enterprise Monitor 4.1 Oracle Mysql Enterprise Monitor 8.0.0 Oracle Mysql Enterprise Monitor 8.0.0.8131 Oracle Mysql Enterprise Monitor 8.0.1 Oracle Mysql Enterprise Monitor 8.0.2 Oracle Mysql Enterprise Monitor 8.0.2.8191 Oracle Mysql Enterprise Monitor 8.0.3 Oracle Mysql Enterprise Monitor 8.0.14 Oracle Mysql Enterprise Monitor 8.0.18.1217 Oracle Mysql Enterprise Monitor 8.0.20 Oracle Mysql Enterprise Monitor 8.0.21 Oracle Commerce Guided Search 11.3.2 Oracle FMW Platform 12.2.1.4.0 Oracle FMW Platform 12.2.1.3.0 Oracle Communications Cloud Native Core Policy 1.14.0 Oracle Communications Instant Messaging Server 10.0.1.5.0 Oracle Blockchain Platform - Oracle Blockchain Platform 21.1.2	121
OS	Debian Debian Debian Linux 9.0 Debian Debian Linux 10.0	2
OS	Opensuse Opensuse Leap 15.1 Opensuse Leap 15.2	2
OS	Canonical Canonical Ubuntu Linux 20.04 Canonical Ubuntu Linux 16.04	2

Common Weakness Enumeration (CWE)

CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References