Vulnerability Change Records for CVE-2020-9484

Change History

CVE Modified by Apache Software Foundation 5/24/2020 3:15:11 PM

Action Type Old Value New Value
Added Reference

								
							
							
						
https://lists.apache.org/thread.html/r26950738f4b4ca2d256597cf391d52d3450fa665c297ea5ca38f5469@%3Cusers.tomcat.apache.org%3E [No Types Assigned]

CVE Modified by Apache Software Foundation 1/20/2021 10:15:44 AM

Action Type Old Value New Value
Added Reference

								
							
							
						
https://www.oracle.com/security-alerts/cpujan2021.html [No Types Assigned]

CVE Modified by Apache Software Foundation 7/12/2020 7:15:12 PM

Action Type Old Value New Value
Added Reference

								
							
							
						
https://lists.debian.org/debian-lts-announce/2020/07/msg00010.html [No Types Assigned]

CVE Modified by Apache Software Foundation 6/03/2020 5:15:11 AM

Action Type Old Value New Value
Added Reference

								
							
							
						
http://seclists.org/fulldisclosure/2020/Jun/6 [No Types Assigned]

CVE Modified by Apache Software Foundation 6/15/2020 2:15:16 PM

Action Type Old Value New Value
Added Reference

								
							
							
						
https://security.gentoo.org/glsa/202006-21 [No Types Assigned]

CVE Modified by Apache Software Foundation 5/21/2020 9:15:09 AM

Action Type Old Value New Value
Added Reference

								
							
							
						
https://lists.apache.org/thread.html/rf70f53af27e04869bdac18b1fc14a3ee529e59eb12292c8791a77926@%3Cusers.tomcat.apache.org%3E [No Types Assigned]

CVE Modified by Apache Software Foundation 6/25/2020 8:15:13 PM

Action Type Old Value New Value
Added Reference

								
							
							
						
https://lists.apache.org/thread.html/rb1c0fb105ce2b93b7ec6fc1b77dd208022621a91c12d1f580813cfed@%3Cdev.tomcat.apache.org%3E [No Types Assigned]

CVE Modified by Apache Software Foundation 10/20/2020 6:15:45 PM

Action Type Old Value New Value
Added Reference

								
							
							
						
https://www.oracle.com/security-alerts/cpuoct2020.html [No Types Assigned]

CVE Modified by Apache Software Foundation 5/28/2020 4:15:12 PM

Action Type Old Value New Value
Added Reference

								
							
							
						
https://lists.debian.org/debian-lts-announce/2020/05/msg00026.html [No Types Assigned]

CVE Modified by Apache Software Foundation 5/28/2020 9:15:12 AM

Action Type Old Value New Value
Added Reference

								
							
							
						
https://security.netapp.com/advisory/ntap-20200528-0005/ [No Types Assigned]

CVE Modified by Apache Software Foundation 5/23/2020 5:15:10 PM

Action Type Old Value New Value
Added Reference

								
							
							
						
https://lists.debian.org/debian-lts-announce/2020/05/msg00020.html [No Types Assigned]

CVE Modified by Apache Software Foundation 6/22/2020 11:15:13 PM

Action Type Old Value New Value
Added Reference

								
							
							
						
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GIQHXENTLYUNOES4LXVNJ2NCUQQRF5VJ/ [No Types Assigned]
Added Reference

								
							
							
						
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WJ7XHKWJWDNWXUJH6UB7CLIW4TWOZ26N/ [No Types Assigned]

CVE Modified by Apache Software Foundation 7/14/2020 11:15:53 PM

Action Type Old Value New Value
Added Reference

								
							
							
						
https://www.oracle.com/security-alerts/cpujul2020.html [No Types Assigned]

CVE Modified by Apache Software Foundation 10/13/2020 7:15:13 AM

Action Type Old Value New Value
Added Reference

								
							
							
						
https://lists.apache.org/thread.html/r123b3ebe389f46f9d337923f393cdae4d3e9b78d982d706712f0898c@%3Ccommits.tomee.apache.org%3E [No Types Assigned]
Added Reference

								
							
							
						
https://lists.apache.org/thread.html/raa4123e472175bb052fbba165d37187cea923f755e8f3f30d124cb3f@%3Ccommits.tomee.apache.org%3E [No Types Assigned]
Added Reference

								
							
							
						
https://lists.apache.org/thread.html/rc8473b08abdf3c16494ed817bec1717a0ee0c8080315bc27db5f21c3@%3Ccommits.tomee.apache.org%3E [No Types Assigned]
Added Reference

								
							
							
						
https://lists.apache.org/thread.html/rf59c72572b9fee674a5d5cc6afeca4ffc3918a02c354a81cc50b7119@%3Ccommits.tomee.apache.org%3E [No Types Assigned]

CVE Modified by Apache Software Foundation 6/03/2020 2:15:23 PM

Action Type Old Value New Value
Added Reference

								
							
							
						
http://packetstormsecurity.com/files/157924/Apache-Tomcat-CVE-2020-9484-Proof-Of-Concept.html [No Types Assigned]

CVE Modified by Apache Software Foundation 5/24/2020 11:15:10 PM

Action Type Old Value New Value
Added Reference

								
							
							
						
http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00057.html [No Types Assigned]

CVE Modified by Apache Software Foundation 8/10/2020 5:15:12 PM

Action Type Old Value New Value
Added Reference

								
							
							
						
https://usn.ubuntu.com/4448-1/ [No Types Assigned]

CVE Modified by Apache Software Foundation 10/27/2020 4:15:22 PM

Action Type Old Value New Value
Added Reference

								
							
							
						
https://usn.ubuntu.com/4596-1/ [No Types Assigned]

Modified Analysis 6/04/2020 10:54:14 AM

Action Type Old Value New Value
Added CPE Configuration

								
							
							
						
OR
     *cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
     *cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*
Added CVSS V2

								
							
							
						
NIST (AV:L/AC:M/Au:N/C:P/I:P/A:P)
Removed CVSS V2
NIST (AV:N/AC:M/Au:N/C:P/I:P/A:P)

								
						
Added CVSS V3.1

								
							
							
						
NIST AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Removed CVSS V3.1
NIST AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

								
						
Changed Reference Type
http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00057.html No Types Assigned
http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00057.html Third Party Advisory
Changed Reference Type
http://packetstormsecurity.com/files/157924/Apache-Tomcat-CVE-2020-9484-Proof-Of-Concept.html No Types Assigned
http://packetstormsecurity.com/files/157924/Apache-Tomcat-CVE-2020-9484-Proof-Of-Concept.html Third Party Advisory, VDB Entry
Changed Reference Type
http://seclists.org/fulldisclosure/2020/Jun/6 No Types Assigned
http://seclists.org/fulldisclosure/2020/Jun/6 Mailing List, Third Party Advisory
Changed Reference Type
https://lists.apache.org/thread.html/r26950738f4b4ca2d256597cf391d52d3450fa665c297ea5ca38f5469@%3Cusers.tomcat.apache.org%3E No Types Assigned
https://lists.apache.org/thread.html/r26950738f4b4ca2d256597cf391d52d3450fa665c297ea5ca38f5469@%3Cusers.tomcat.apache.org%3E Third Party Advisory
Changed Reference Type
https://lists.apache.org/thread.html/r7bc247fffcb1d58415215c861d2354bd653c86266230d78a93c71ae2@%3Cdev.tomcat.apache.org%3E No Types Assigned
https://lists.apache.org/thread.html/r7bc247fffcb1d58415215c861d2354bd653c86266230d78a93c71ae2@%3Cdev.tomcat.apache.org%3E Third Party Advisory
Changed Reference Type
https://lists.debian.org/debian-lts-announce/2020/05/msg00020.html No Types Assigned
https://lists.debian.org/debian-lts-announce/2020/05/msg00020.html Third Party Advisory
Changed Reference Type
https://lists.debian.org/debian-lts-announce/2020/05/msg00026.html No Types Assigned
https://lists.debian.org/debian-lts-announce/2020/05/msg00026.html Third Party Advisory
Changed Reference Type
https://security.netapp.com/advisory/ntap-20200528-0005/ No Types Assigned
https://security.netapp.com/advisory/ntap-20200528-0005/ Third Party Advisory

Modified Analysis 8/19/2020 2:56:50 PM

Action Type Old Value New Value
Added CPE Configuration

								
							
							
						
OR
     *cpe:2.3:a:oracle:instantis_enterprisetrack:*:*:*:*:*:*:*:* versions from (including) 17.1 up to (including) 17.3
Added CPE Configuration

								
							
							
						
OR
     *cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
Added CPE Configuration

								
							
							
						
OR
     *cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*
     *cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*
Added CPE Configuration

								
							
							
						
OR
     *cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*
Changed CPE Configuration
OR
     *cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
     *cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*
OR
     *cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
     *cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
     *cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
Changed Reference Type
https://lists.apache.org/thread.html/rb1c0fb105ce2b93b7ec6fc1b77dd208022621a91c12d1f580813cfed@%3Cdev.tomcat.apache.org%3E No Types Assigned
https://lists.apache.org/thread.html/rb1c0fb105ce2b93b7ec6fc1b77dd208022621a91c12d1f580813cfed@%3Cdev.tomcat.apache.org%3E Mailing List, Patch, Vendor Advisory
Changed Reference Type
https://lists.debian.org/debian-lts-announce/2020/07/msg00010.html No Types Assigned
https://lists.debian.org/debian-lts-announce/2020/07/msg00010.html Mailing List, Third Party Advisory
Changed Reference Type
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GIQHXENTLYUNOES4LXVNJ2NCUQQRF5VJ/ No Types Assigned
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GIQHXENTLYUNOES4LXVNJ2NCUQQRF5VJ/ Mailing List, Third Party Advisory
Changed Reference Type
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WJ7XHKWJWDNWXUJH6UB7CLIW4TWOZ26N/ No Types Assigned
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WJ7XHKWJWDNWXUJH6UB7CLIW4TWOZ26N/ Mailing List, Third Party Advisory
Changed Reference Type
https://security.gentoo.org/glsa/202006-21 No Types Assigned
https://security.gentoo.org/glsa/202006-21 Third Party Advisory
Changed Reference Type
https://usn.ubuntu.com/4448-1/ No Types Assigned
https://usn.ubuntu.com/4448-1/ Third Party Advisory
Changed Reference Type
https://www.debian.org/security/2020/dsa-4727 No Types Assigned
https://www.debian.org/security/2020/dsa-4727 Third Party Advisory
Changed Reference Type
https://www.oracle.com/security-alerts/cpujul2020.html No Types Assigned
https://www.oracle.com/security-alerts/cpujul2020.html Patch, Third Party Advisory

CVE Modified by Apache Software Foundation 7/18/2020 12:15:11 PM

Action Type Old Value New Value
Added Reference

								
							
							
						
https://www.debian.org/security/2020/dsa-4727 [No Types Assigned]

CVE Modified by Apache Software Foundation 3/01/2021 11:15:13 AM

Action Type Old Value New Value
Added Reference

								
							
							
						
http://www.openwall.com/lists/oss-security/2021/03/01/2 [No Types Assigned]

CVE Modified by Apache Software Foundation 3/01/2021 8:15:13 AM

Action Type Old Value New Value
Added Reference

								
							
							
						
https://lists.apache.org/thread.html/rf6d5d57b114678d8898005faef31e9fd6d7c981fcc4ccfc3bc272fc9@%3Cdev.tomcat.apache.org%3E [No Types Assigned]
Added Reference

								
							
							
						
https://lists.apache.org/thread.html/rfe62fbf9d4c314f166fe8c668e50e5d9dd882a99447f26f0367474bf@%3Cannounce.apache.org%3E [No Types Assigned]
Added Reference

								
							
							
						
https://lists.apache.org/thread.html/rfe62fbf9d4c314f166fe8c668e50e5d9dd882a99447f26f0367474bf@%3Cannounce.tomcat.apache.org%3E [No Types Assigned]
Added Reference

								
							
							
						
https://lists.apache.org/thread.html/rfe62fbf9d4c314f166fe8c668e50e5d9dd882a99447f26f0367474bf@%3Cdev.tomcat.apache.org%3E [No Types Assigned]
Added Reference

								
							
							
						
https://lists.apache.org/thread.html/rfe62fbf9d4c314f166fe8c668e50e5d9dd882a99447f26f0367474bf@%3Cusers.tomcat.apache.org%3E [No Types Assigned]

Initial Analysis 5/22/2020 2:11:11 PM

Action Type Old Value New Value
Added CPE Configuration

								
							
							
						
OR
     *cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* versions from (including) 7.0.0 up to (including) 7.0.103
     *cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* versions from (including) 8.5.0 up to (including) 8.5.54
     *cpe:2.3:a:apache:tomcat:9.0.0:milestone1:*:*:*:*:*:*
     *cpe:2.3:a:apache:tomcat:9.0.0:milestone10:*:*:*:*:*:*
     *cpe:2.3:a:apache:tomcat:9.0.0:milestone11:*:*:*:*:*:*
     *cpe:2.3:a:apache:tomcat:9.0.0:milestone12:*:*:*:*:*:*
     *cpe:2.3:a:apache:tomcat:9.0.0:milestone13:*:*:*:*:*:*
     *cpe:2.3:a:apache:tomcat:9.0.0:milestone14:*:*:*:*:*:*
     *cpe:2.3:a:apache:tomcat:9.0.0:milestone15:*:*:*:*:*:*
     *cpe:2.3:a:apache:tomcat:9.0.0:milestone16:*:*:*:*:*:*
     *cpe:2.3:a:apache:tomcat:9.0.0:milestone17:*:*:*:*:*:*
     *cpe:2.3:a:apache:tomcat:9.0.0:milestone18:*:*:*:*:*:*
     *cpe:2.3:a:apache:tomcat:9.0.0:milestone19:*:*:*:*:*:*
     *cpe:2.3:a:apache:tomcat:9.0.0:milestone2:*:*:*:*:*:*
     *cpe:2.3:a:apache:tomcat:9.0.0:milestone20:*:*:*:*:*:*
     *cpe:2.3:a:apache:tomcat:9.0.0:milestone21:*:*:*:*:*:*
     *cpe:2.3:a:apache:tomcat:9.0.0:milestone22:*:*:*:*:*:*
     *cpe:2.3:a:apache:tomcat:9.0.0:milestone23:*:*:*:*:*:*
     *cpe:2.3:a:apache:tomcat:9.0.0:milestone24:*:*:*:*:*:*
     *cpe:2.3:a:apache:tomcat:9.0.0:milestone25:*:*:*:*:*:*
     *cpe:2.3:a:apache:tomcat:9.0.0:milestone26:*:*:*:*:*:*
     *cpe:2.3:a:apache:tomcat:9.0.0:milestone27:*:*:*:*:*:*
     *cpe:2.3:a:apache:tomcat:9.0.0:milestone3:*:*:*:*:*:*
     *cpe:2.3:a:apache:tomcat:9.0.0:milestone4:*:*:*:*:*:*
     *cpe:2.3:a:apache:tomcat:9.0.0:milestone5:*:*:*:*:*:*
     *cpe:2.3:a:apache:tomcat:9.0.0:milestone6:*:*:*:*:*:*
     *cpe:2.3:a:apache:tomcat:9.0.0:milestone7:*:*:*:*:*:*
     *cpe:2.3:a:apache:tomcat:9.0.0:milestone8:*:*:*:*:*:*
     *cpe:2.3:a:apache:tomcat:9.0.0:milestone9:*:*:*:*:*:*
     *cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* versions from (including) 9.0.1 up to (including) 9.0.34
     *cpe:2.3:a:apache:tomcat:10.0.0:milestone1:*:*:*:*:*:*
     *cpe:2.3:a:apache:tomcat:10.0.0:milestone2:*:*:*:*:*:*
     *cpe:2.3:a:apache:tomcat:10.0.0:milestone3:*:*:*:*:*:*
     *cpe:2.3:a:apache:tomcat:10.0.0:milestone4:*:*:*:*:*:*
Added CVSS V2

								
							
							
						
NIST (AV:N/AC:M/Au:N/C:P/I:P/A:P)
Added CVSS V3.1

								
							
							
						
NIST AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Added CWE

								
							
							
						
NIST CWE-502
Changed Reference Type
https://lists.apache.org/thread.html/r77eae567ed829da9012cadb29af17f2df8fa23bf66faf88229857bb1%40%3Cannounce.tomcat.apache.org%3E No Types Assigned
https://lists.apache.org/thread.html/r77eae567ed829da9012cadb29af17f2df8fa23bf66faf88229857bb1%40%3Cannounce.tomcat.apache.org%3E Mailing List, Mitigation, Patch, Third Party Advisory
Changed Reference Type
https://lists.apache.org/thread.html/rf70f53af27e04869bdac18b1fc14a3ee529e59eb12292c8791a77926@%3Cusers.tomcat.apache.org%3E No Types Assigned
https://lists.apache.org/thread.html/rf70f53af27e04869bdac18b1fc14a3ee529e59eb12292c8791a77926@%3Cusers.tomcat.apache.org%3E Mailing List, Mitigation, Patch, Third Party Advisory

CVE Modified by Apache Software Foundation 5/27/2020 3:15:10 PM

Action Type Old Value New Value
Added Reference

								
							
							
						
https://lists.apache.org/thread.html/r7bc247fffcb1d58415215c861d2354bd653c86266230d78a93c71ae2@%3Cdev.tomcat.apache.org%3E [No Types Assigned]

CVE Modified by Apache Software Foundation 10/14/2020 4:15:14 AM

Action Type Old Value New Value
Added Reference

								
							
							
						
https://kc.mcafee.com/corporate/index?page=content&id=SB10332 [No Types Assigned]