KB484705: Check if CVE-2020-13943 Apache Tomcat Vulnerability impacts Apache 9.0.31 used by MicroStrategy Library 2019 and 2020

Senior Cloud Support Engineer III • MicroStrategy

This article addresses the security vulnerability detected in Apache Tomcat, which can affect your MicroStrategy Library usage. This article also provides steps to check if your configuration is affected, as well as workarounds to mitigate and resolve the issues.

Description

You may be concerned if Strategy Library usage is affected by the security vulnerability detected in Apache Tomcat: CVE-2020-13943.

CVE-2020-13943 Apache Tomcat HTTP/2 Request mix-upSeverity: ModerateVendor: The Apache Software FoundationVersions Affected:Apache Tomcat 10.0.0-M1 to 10.0.0-M7Apache Tomcat 9.0.0.M5 to 9.0.37Apache Tomcat 8.5.1 to 8.5.57Description:If an HTTP/2 client exceeded the agreed maximum number of concurrent streams for a connection (in violation of the HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This could lead to users seeing responses for unexpected resources.Mitigation:- Upgrade to Apache Tomcat 10.0.0-M8 or later- Upgrade to Apache Tomcat 9.0.38 or later- Upgrade to Apache Tomcat 8.5.58 or laterCredit:This issue was identified by the Apache Tomcat Security Team.References:[1] http://tomcat.apache.org/security-10.html[2] http://tomcat.apache.org/security-9.html[3] http://tomcat.apache.org/security-8.html

Solution

This known Apache Tomcat security issue only has an impact on HTTP/2. Generally, the used protocol is HTTP/1.1. To check whether you configured to HTTP/2, go to
```
TOMCAT_INSTALLED_PATH/conf/server.xml
```
.
If the following parameter exists, then you have configured HTTP/2, which is impacted by the vulnerability.
```
<UpgradeProtocol className="org.apache.coyote.http2.Http2Protocol" />
```
If using HTTP/2, you can enlarge the maximum number of concurrent streams that Tomcat allows a client to send via the 'maxConcurrentStreams' attribute of the HTTP2 protocol element. This workaround reduces the possible impacts, but does not complete resolve the issue.
To resolve the security issue if HTTP/2 is used, you can migrate the Tomcat server to 9.0.39, which fixes this issue. Accordingly, you need to upgrade Strategy Library to version 11.3 or later, which certifies tomcat 9.0.39.

Comment

0 comments

Details

Knowledge Article

Published:

November 12, 2020

Last Updated:

November 12, 2020

Description

You may be concerned if Strategy Library usage is affected by the security vulnerability detected in Apache Tomcat: CVE-2020-13943.

CVE-2020-13943 Apache Tomcat HTTP/2 Request mix-upSeverity: ModerateVendor: The Apache Software FoundationVersions Affected:Apache Tomcat 10.0.0-M1 to 10.0.0-M7Apache Tomcat 9.0.0.M5 to 9.0.37Apache Tomcat 8.5.1 to 8.5.57Description:If an HTTP/2 client exceeded the agreed maximum number of concurrent streams for a connection (in violation of the HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This could lead to users seeing responses for unexpected resources.Mitigation:- Upgrade to Apache Tomcat 10.0.0-M8 or later- Upgrade to Apache Tomcat 9.0.38 or later- Upgrade to Apache Tomcat 8.5.58 or laterCredit:This issue was identified by the Apache Tomcat Security Team.References:[1] http://tomcat.apache.org/security-10.html[2] http://tomcat.apache.org/security-9.html[3] http://tomcat.apache.org/security-8.html

Solution

This known Apache Tomcat security issue only has an impact on HTTP/2. Generally, the used protocol is HTTP/1.1. To check whether you configured to HTTP/2, go to

TOMCAT_INSTALLED_PATH/conf/server.xml

.
If the following parameter exists, then you have configured HTTP/2, which is impacted by the vulnerability.

<UpgradeProtocol className="org.apache.coyote.http2.Http2Protocol" />

If using HTTP/2, you can enlarge the maximum number of concurrent streams that Tomcat allows a client to send via the 'maxConcurrentStreams' attribute of the HTTP2 protocol element. This workaround reduces the possible impacts, but does not complete resolve the issue.

To resolve the security issue if HTTP/2 is used, you can migrate the Tomcat server to 9.0.39, which fixes this issue. Accordingly, you need to upgrade Strategy Library to version 11.3 or later, which certifies tomcat 9.0.39.