[Secure-testing-team] Bug#860070: tomcat8: CVE-2017-5650

[Salvatore Bonaccorso]

Source: tomcat8
Version: 8.5.11-1
Severity: important
Tags: security upstream

Hi,

the following vulnerability was published for tomcat8.

CVE-2017-5650[0]:
|The handling of an HTTP/2 GOAWAY frame for a connection did not close
|streams associated with that connection that were currently waiting for
|a WINDOW_UPDATE before allowing the application to write more data.
|These waiting streams each consumed a thread. A malicious client could
|therefore construct a series of HTTP/2 requests that would consume all
|available processing threads.

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2017-5650
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5650

Regards,
Salvatore