NVD Vulnerability Detail

CVE-2020-13943

Summary	If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This could lead to users seeing responses for unexpected resources.
Publication Date	Oct. 12, 2020, 11:15 p.m.
Registration Date	Jan. 26, 2021, 11:52 a.m.
Last Update	Nov. 21, 2024, 2:02 p.m.

CVSS3.1 : MEDIUM
スコア	4.3
Vector	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
攻撃元区分(AV)	ネットワーク
攻撃条件の複雑さ(AC)	低
攻撃に必要な特権レベル(PR)	低
利用者の関与(UI)	不要
影響の想定範囲(S)	変更なし
機密性への影響(C)	低
完全性への影響(I)	なし
可用性への影響(A)	なし

CVSS2.0 : MEDIUM
Score	4.0
Vector	AV:N/AC:L/Au:S/C:P/I:N/A:N
攻撃元区分(AV)	ネットワーク
攻撃条件の複雑さ(AC)	低
攻撃前の認証要否(Au)	単一
機密性への影響(C)	低
完全性への影響(I)	なし
可用性への影響(A)	なし
Get all privileges.	いいえ
Get user privileges	いいえ
Get other privileges	いいえ
User operation required	いいえ

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:apache:tomcat:8.5.2:::::::*
cpe:2.3:a:apache:tomcat:8.5.9:::::::*
cpe:2.3:a:apache:tomcat:8.5.4:::::::*
cpe:2.3:a:apache:tomcat:8.5.0:::::::*
cpe:2.3:a:apache:tomcat:8.5.15:::::::*
cpe:2.3:a:apache:tomcat:8.5.10:::::::*
cpe:2.3:a:apache:tomcat:8.5.13:::::::*
cpe:2.3:a:apache:tomcat:8.5.14:::::::*
cpe:2.3:a:apache:tomcat:8.5.5:::::::*
cpe:2.3:a:apache:tomcat:8.5.3:::::::*
cpe:2.3:a:apache:tomcat:8.5.6:::::::*
cpe:2.3:a:apache:tomcat:8.5.7:::::::*
cpe:2.3:a:apache:tomcat:8.5.8:::::::*
cpe:2.3:a:apache:tomcat:8.5.12:::::::*
cpe:2.3:a:apache:tomcat:8.5.11:::::::*
cpe:2.3:a:apache:tomcat:8.5.1:::::::*
cpe:2.3:a:apache:tomcat:8.5.16:::::::*
cpe:2.3:a:apache:tomcat:8.5.17:::::::*
cpe:2.3:a:apache:tomcat:8.5.18:::::::*
cpe:2.3:a:apache:tomcat:8.5.19:::::::*
cpe:2.3:a:apache:tomcat:8.5.20:::::::*
cpe:2.3:a:apache:tomcat:8.5.21:::::::*
cpe:2.3:a:apache:tomcat:8.5.22:::::::*
cpe:2.3:a:apache:tomcat:9.0.1:::::::*
cpe:2.3:a:apache:tomcat:9.0.2:::::::*
cpe:2.3:a:apache:tomcat:9.0.3:::::::*
cpe:2.3:a:apache:tomcat:9.0.4:::::::*
cpe:2.3:a:apache:tomcat:9.0.0:milestone10::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone11::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone12::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone13::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone14::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone15::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone16::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone17::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone18::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone19::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone20::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone21::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone22::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone23::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone24::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone25::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone26::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone27::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone5::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone6::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone7::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone8::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone9::::::
cpe:2.3:a:apache:tomcat:10.0.0:milestone3::::::
cpe:2.3:a:apache:tomcat:10.0.0:milestone4::::::
cpe:2.3:a:apache:tomcat:10.0.0:milestone2::::::
cpe:2.3:a:apache:tomcat:10.0.0:milestone1::::::
cpe:2.3:a:apache:tomcat:10.0.0:milestone5::::::
cpe:2.3:a:apache:tomcat:10.0.0:milestone6::::::
cpe:2.3:a:apache:tomcat:9.0.5:::::::*
cpe:2.3:a:apache:tomcat:9.0.6:::::::*
cpe:2.3:a:apache:tomcat:9.0.7:::::::*
cpe:2.3:a:apache:tomcat:9.0.8:::::::*
cpe:2.3:a:apache:tomcat:9.0.9:::::::*
cpe:2.3:a:apache:tomcat:9.0.10:::::::*
cpe:2.3:a:apache:tomcat:9.0.11:::::::*
cpe:2.3:a:apache:tomcat:9.0.12:::::::*
cpe:2.3:a:apache:tomcat:9.0.13:::::::*
cpe:2.3:a:apache:tomcat:9.0.14:::::::*
cpe:2.3:a:apache:tomcat:9.0.15:::::::*
cpe:2.3:a:apache:tomcat:9.0.16:::::::*
cpe:2.3:a:apache:tomcat:9.0.17:::::::*
cpe:2.3:a:apache:tomcat:9.0.18:::::::*
cpe:2.3:a:apache:tomcat:9.0.19:::::::*
cpe:2.3:a:apache:tomcat:9.0.20:::::::*
cpe:2.3:a:apache:tomcat:9.0.21:::::::*
cpe:2.3:a:apache:tomcat:9.0.22:::::::*
cpe:2.3:a:apache:tomcat:9.0.23:::::::*
cpe:2.3:a:apache:tomcat:9.0.24:::::::*
cpe:2.3:a:apache:tomcat:9.0.25:::::::*
cpe:2.3:a:apache:tomcat:9.0.26:::::::*
cpe:2.3:a:apache:tomcat:9.0.27:::::::*
cpe:2.3:a:apache:tomcat:9.0.28:::::::*
cpe:2.3:a:apache:tomcat:9.0.29:::::::*
cpe:2.3:a:apache:tomcat:9.0.30:::::::*
cpe:2.3:a:apache:tomcat:9.0.31:::::::*
cpe:2.3:a:apache:tomcat:9.0.32:::::::*
cpe:2.3:a:apache:tomcat:9.0.33:::::::*
cpe:2.3:a:apache:tomcat:9.0.34:::::::*
cpe:2.3:a:apache:tomcat:9.0.35:::::::*
cpe:2.3:a:apache:tomcat:9.0.36:::::::*
cpe:2.3:a:apache:tomcat:9.0.37:::::::*
cpe:2.3:a:apache:tomcat:10.0.0:milestone7::::::
cpe:2.3:a:apache:tomcat:8.5.23:::::::*
cpe:2.3:a:apache:tomcat:8.5.24:::::::*
cpe:2.3:a:apache:tomcat:8.5.25:::::::*
cpe:2.3:a:apache:tomcat:8.5.26:::::::*
cpe:2.3:a:apache:tomcat:8.5.27:::::::*
cpe:2.3:a:apache:tomcat:8.5.28:::::::*
cpe:2.3:a:apache:tomcat:8.5.29:::::::*
cpe:2.3:a:apache:tomcat:8.5.30:::::::*
cpe:2.3:a:apache:tomcat:8.5.31:::::::*
cpe:2.3:a:apache:tomcat:8.5.32:::::::*
cpe:2.3:a:apache:tomcat:8.5.33:::::::*
cpe:2.3:a:apache:tomcat:8.5.34:::::::*
cpe:2.3:a:apache:tomcat:8.5.35:::::::*
cpe:2.3:a:apache:tomcat:8.5.36:::::::*
cpe:2.3:a:apache:tomcat:8.5.37:::::::*
cpe:2.3:a:apache:tomcat:8.5.38:::::::*
cpe:2.3:a:apache:tomcat:8.5.39:::::::*
cpe:2.3:a:apache:tomcat:8.5.40:::::::*
cpe:2.3:a:apache:tomcat:8.5.41:::::::*
cpe:2.3:a:apache:tomcat:8.5.42:::::::*
cpe:2.3:a:apache:tomcat:8.5.43:::::::*
cpe:2.3:a:apache:tomcat:8.5.44:::::::*
cpe:2.3:a:apache:tomcat:8.5.45:::::::*
cpe:2.3:a:apache:tomcat:8.5.46:::::::*
cpe:2.3:a:apache:tomcat:8.5.47:::::::*
cpe:2.3:a:apache:tomcat:8.5.48:::::::*
cpe:2.3:a:apache:tomcat:8.5.49:::::::*
cpe:2.3:a:apache:tomcat:8.5.50:::::::*
cpe:2.3:a:apache:tomcat:8.5.51:::::::*
cpe:2.3:a:apache:tomcat:8.5.52:::::::*
cpe:2.3:a:apache:tomcat:8.5.53:::::::*
cpe:2.3:a:apache:tomcat:8.5.54:::::::*
cpe:2.3:a:apache:tomcat:8.5.55:::::::*
cpe:2.3:a:apache:tomcat:8.5.56:::::::*
cpe:2.3:a:apache:tomcat:8.5.57:::::::*

Configuration2	or higher	or less	more than	less than
cpe:2.3:o:debian:debian_linux:9.0:::::::*
cpe:2.3:o:debian:debian_linux:10.0:::::::*

Configuration3	or higher	or less	more than	less than
cpe:2.3:a:oracle:instantis_enterprisetrack:17.1:::::::*
cpe:2.3:a:oracle:instantis_enterprisetrack:17.2:::::::*
cpe:2.3:a:oracle:instantis_enterprisetrack:17.3:::::::*
cpe:2.3:a:oracle:sd-wan_edge:9.0:::::::*

Related information, measures and tools

No	URL	タグ
1	http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00002.html	Mailing List Third Party Advisory
2	http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00021.html	Broken Link
3	https://lists.apache.org/thread.html/r4a390027eb27e4550142fac6c8317cc684b157ae314d31514747f307%40%3Cannounce.tomcat.apache.org%3E	Vendor Advisory
4	https://lists.debian.org/debian-lts-announce/2020/10/msg00019.html	Third Party Advisory
5	https://security.netapp.com/advisory/ntap-20201016-0007/	Third Party Advisory
6	https://www.debian.org/security/2021/dsa-4835	Third Party Advisory
7	https://www.oracle.com/security-alerts/cpuApr2021.html	Patch Third Party Advisory
8	http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00002.html	Mailing List Third Party Advisory
9	https://www.oracle.com/security-alerts/cpuApr2021.html	Patch Third Party Advisory
10	https://www.debian.org/security/2021/dsa-4835	Third Party Advisory
11	https://security.netapp.com/advisory/ntap-20201016-0007/	Third Party Advisory
12	https://lists.debian.org/debian-lts-announce/2020/10/msg00019.html	Third Party Advisory
13	https://lists.apache.org/thread.html/r4a390027eb27e4550142fac6c8317cc684b157ae314d31514747f307%40%3Cannounce.tomcat.apache.org%3E	Vendor Advisory
14	http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00021.html	Broken Link

Common Vulnerabilities List

JVN Vulnerability Information

Apache Tomcat における HTTP/2 リクエスト処理の不備に起因する情報漏えいの脆弱性

Title	Apache Tomcat における HTTP/2 リクエスト処理の不備に起因する情報漏えいの脆弱性
Summary	Apache Tomcat には、 HTTP/2 リクエスト処理の不備に起因する情報漏えいの脆弱性が存在します。 The Apache Software Foundation から、Apache Tomcat の脆弱性に対するアップデートが公開されました。 * HTTP/2 リクエストの取り違え - CVE-2020-13943 HTTP/2 クライアントが接続許可された最大同時ストリーム数を超えた場合、その接続における後続のリクエストにおいて、意図した HTTP ヘッダではなく、以前送信されたリクエストの HTTP ヘッダに置き換わる可能性があります。その結果、ユーザが予期しないリソースへの応答が表示される可能性があります。
Possible impacts	遠隔の第三者によって細工された HTTP/2 リクエストを送信され、予期しないリソースへの応答が表示されることで、機微な情報が取得される可能性があります。
Solution	[アップデートする] 開発者が提供する情報をもとに、最新版へアップデートしてください。開発者は、本脆弱性の対策版として次のバージョンをリリースしています。　　* Apache Tomcat 10.0.0-M8 　　* Apache Tomcat 9.0.38 　　* Apache Tomcat 8.5.58
Publication Date	Oct. 14, 2020, midnight
Registration Date	Oct. 15, 2020, 5:19 p.m.
Last Update	Aug. 10, 2021, 5:25 p.m.

Affected System

Apache Software Foundation

Apache Tomcat 10.0.0-M1 から 10.0.0-M7 まで

Apache Tomcat 8.5.0 から 8.5.57 まで

Apache Tomcat 9.0.0.M1 から 9.0.37 まで

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2020-13943	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13943
National Vulnerability Database (NVD)
2	CVE-2020-13943	https://nvd.nist.gov/vuln/detail/CVE-2020-13943

ベンダー情報

No	Name	URL
Apache Software Foundation
1	Fixed in Apache Tomcat 10.0.0-M8	http://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.0.0-M8
2	Fixed in Apache Tomcat 8.5.58	http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.58
3	Fixed in Apache Tomcat 9.0.38	http://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.38
NEC製品セキュリティ情報
4	Apache Tomcat における HTTP/2 リクエスト処理の不備に起因する情報漏えいの脆弱性	https://jpn.nec.com/security-info/secinfo/nv20-016.html

その他

No	Name	URL
JVN
1	JVNVU#97307781	https://jvn.jp/vu/JVNVU97307781/index.html

Change Log

No	Changed Details	Date of change
1	[2020年10月15日] 掲載	Oct. 15, 2020, 5:19 p.m.
2	[2021年08月10日] ベンダ情報：日本電気 (Apache Tomcat における HTTP/2 リクエスト処理の不備に起因する情報漏えいの脆弱性) を追加	Aug. 10, 2021, 4:20 p.m.

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:apache:tomcat:8.5.2:::::::*
cpe:2.3:a:apache:tomcat:8.5.9:::::::*
cpe:2.3:a:apache:tomcat:8.5.4:::::::*
cpe:2.3:a:apache:tomcat:8.5.0:::::::*
cpe:2.3:a:apache:tomcat:8.5.15:::::::*
cpe:2.3:a:apache:tomcat:8.5.10:::::::*
cpe:2.3:a:apache:tomcat:8.5.13:::::::*
cpe:2.3:a:apache:tomcat:8.5.14:::::::*
cpe:2.3:a:apache:tomcat:8.5.5:::::::*
cpe:2.3:a:apache:tomcat:8.5.3:::::::*
cpe:2.3:a:apache:tomcat:8.5.6:::::::*
cpe:2.3:a:apache:tomcat:8.5.7:::::::*
cpe:2.3:a:apache:tomcat:8.5.8:::::::*
cpe:2.3:a:apache:tomcat:8.5.12:::::::*
cpe:2.3:a:apache:tomcat:8.5.11:::::::*
cpe:2.3:a:apache:tomcat:8.5.1:::::::*
cpe:2.3:a:apache:tomcat:8.5.16:::::::*
cpe:2.3:a:apache:tomcat:8.5.17:::::::*
cpe:2.3:a:apache:tomcat:8.5.18:::::::*
cpe:2.3:a:apache:tomcat:8.5.19:::::::*
cpe:2.3:a:apache:tomcat:8.5.20:::::::*
cpe:2.3:a:apache:tomcat:8.5.21:::::::*
cpe:2.3:a:apache:tomcat:8.5.22:::::::*
cpe:2.3:a:apache:tomcat:9.0.1:::::::*
cpe:2.3:a:apache:tomcat:9.0.2:::::::*
cpe:2.3:a:apache:tomcat:9.0.3:::::::*
cpe:2.3:a:apache:tomcat:9.0.4:::::::*
cpe:2.3:a:apache:tomcat:9.0.0:milestone10::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone11::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone12::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone13::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone14::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone15::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone16::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone17::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone18::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone19::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone20::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone21::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone22::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone23::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone24::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone25::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone26::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone27::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone5::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone6::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone7::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone8::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone9::::::
cpe:2.3:a:apache:tomcat:10.0.0:milestone3::::::
cpe:2.3:a:apache:tomcat:10.0.0:milestone4::::::
cpe:2.3:a:apache:tomcat:10.0.0:milestone2::::::
cpe:2.3:a:apache:tomcat:10.0.0:milestone1::::::
cpe:2.3:a:apache:tomcat:10.0.0:milestone5::::::
cpe:2.3:a:apache:tomcat:10.0.0:milestone6::::::
cpe:2.3:a:apache:tomcat:9.0.5:::::::*
cpe:2.3:a:apache:tomcat:9.0.6:::::::*
cpe:2.3:a:apache:tomcat:9.0.7:::::::*
cpe:2.3:a:apache:tomcat:9.0.8:::::::*
cpe:2.3:a:apache:tomcat:9.0.9:::::::*
cpe:2.3:a:apache:tomcat:9.0.10:::::::*
cpe:2.3:a:apache:tomcat:9.0.11:::::::*
cpe:2.3:a:apache:tomcat:9.0.12:::::::*
cpe:2.3:a:apache:tomcat:9.0.13:::::::*
cpe:2.3:a:apache:tomcat:9.0.14:::::::*
cpe:2.3:a:apache:tomcat:9.0.15:::::::*
cpe:2.3:a:apache:tomcat:9.0.16:::::::*
cpe:2.3:a:apache:tomcat:9.0.17:::::::*
cpe:2.3:a:apache:tomcat:9.0.18:::::::*
cpe:2.3:a:apache:tomcat:9.0.19:::::::*
cpe:2.3:a:apache:tomcat:9.0.20:::::::*
cpe:2.3:a:apache:tomcat:9.0.21:::::::*
cpe:2.3:a:apache:tomcat:9.0.22:::::::*
cpe:2.3:a:apache:tomcat:9.0.23:::::::*
cpe:2.3:a:apache:tomcat:9.0.24:::::::*
cpe:2.3:a:apache:tomcat:9.0.25:::::::*
cpe:2.3:a:apache:tomcat:9.0.26:::::::*
cpe:2.3:a:apache:tomcat:9.0.27:::::::*
cpe:2.3:a:apache:tomcat:9.0.28:::::::*
cpe:2.3:a:apache:tomcat:9.0.29:::::::*
cpe:2.3:a:apache:tomcat:9.0.30:::::::*
cpe:2.3:a:apache:tomcat:9.0.31:::::::*
cpe:2.3:a:apache:tomcat:9.0.32:::::::*
cpe:2.3:a:apache:tomcat:9.0.33:::::::*
cpe:2.3:a:apache:tomcat:9.0.34:::::::*
cpe:2.3:a:apache:tomcat:9.0.35:::::::*
cpe:2.3:a:apache:tomcat:9.0.36:::::::*
cpe:2.3:a:apache:tomcat:9.0.37:::::::*
cpe:2.3:a:apache:tomcat:10.0.0:milestone7::::::
cpe:2.3:a:apache:tomcat:8.5.23:::::::*
cpe:2.3:a:apache:tomcat:8.5.24:::::::*
cpe:2.3:a:apache:tomcat:8.5.25:::::::*
cpe:2.3:a:apache:tomcat:8.5.26:::::::*
cpe:2.3:a:apache:tomcat:8.5.27:::::::*
cpe:2.3:a:apache:tomcat:8.5.28:::::::*
cpe:2.3:a:apache:tomcat:8.5.29:::::::*
cpe:2.3:a:apache:tomcat:8.5.30:::::::*
cpe:2.3:a:apache:tomcat:8.5.31:::::::*
cpe:2.3:a:apache:tomcat:8.5.32:::::::*
cpe:2.3:a:apache:tomcat:8.5.33:::::::*
cpe:2.3:a:apache:tomcat:8.5.34:::::::*
cpe:2.3:a:apache:tomcat:8.5.35:::::::*
cpe:2.3:a:apache:tomcat:8.5.36:::::::*
cpe:2.3:a:apache:tomcat:8.5.37:::::::*
cpe:2.3:a:apache:tomcat:8.5.38:::::::*
cpe:2.3:a:apache:tomcat:8.5.39:::::::*
cpe:2.3:a:apache:tomcat:8.5.40:::::::*
cpe:2.3:a:apache:tomcat:8.5.41:::::::*
cpe:2.3:a:apache:tomcat:8.5.42:::::::*
cpe:2.3:a:apache:tomcat:8.5.43:::::::*
cpe:2.3:a:apache:tomcat:8.5.44:::::::*
cpe:2.3:a:apache:tomcat:8.5.45:::::::*
cpe:2.3:a:apache:tomcat:8.5.46:::::::*
cpe:2.3:a:apache:tomcat:8.5.47:::::::*
cpe:2.3:a:apache:tomcat:8.5.48:::::::*
cpe:2.3:a:apache:tomcat:8.5.49:::::::*
cpe:2.3:a:apache:tomcat:8.5.50:::::::*
cpe:2.3:a:apache:tomcat:8.5.51:::::::*
cpe:2.3:a:apache:tomcat:8.5.52:::::::*
cpe:2.3:a:apache:tomcat:8.5.53:::::::*
cpe:2.3:a:apache:tomcat:8.5.54:::::::*
cpe:2.3:a:apache:tomcat:8.5.55:::::::*
cpe:2.3:a:apache:tomcat:8.5.56:::::::*
cpe:2.3:a:apache:tomcat:8.5.57:::::::*