NVD脆弱性詳細

CVE-2020-13943

概要	If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This could lead to users seeing responses for unexpected resources.
公表日	2020年10月12日23:15
登録日	2021年1月26日11:52
最終更新日	2024年11月21日14:02

CVSS3.1 : MEDIUM
スコア	4.3
ベクター	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
攻撃元区分(AV)	ネットワーク
攻撃条件の複雑さ(AC)	低
攻撃に必要な特権レベル(PR)	低
利用者の関与(UI)	不要
影響の想定範囲(S)	変更なし
機密性への影響(C)	低
完全性への影響(I)	なし
可用性への影響(A)	なし

CVSS2.0 : MEDIUM
スコア	4.0
ベクター	AV:N/AC:L/Au:S/C:P/I:N/A:N
攻撃元区分(AV)	ネットワーク
攻撃条件の複雑さ(AC)	低
攻撃前の認証要否(Au)	単一
機密性への影響(C)	低
完全性への影響(I)	なし
可用性への影響(A)	なし
全ての特権を取得	いいえ
ユーザー権限を取得	いいえ
その他の権限を取得	いいえ
ユーザー操作が必要	いいえ

影響を受けるソフトウェアの構成

構成1	以上	以下	より上	未満
cpe:2.3:a:apache:tomcat:8.5.2:::::::*
cpe:2.3:a:apache:tomcat:8.5.9:::::::*
cpe:2.3:a:apache:tomcat:8.5.4:::::::*
cpe:2.3:a:apache:tomcat:8.5.0:::::::*
cpe:2.3:a:apache:tomcat:8.5.15:::::::*
cpe:2.3:a:apache:tomcat:8.5.10:::::::*
cpe:2.3:a:apache:tomcat:8.5.13:::::::*
cpe:2.3:a:apache:tomcat:8.5.14:::::::*
cpe:2.3:a:apache:tomcat:8.5.5:::::::*
cpe:2.3:a:apache:tomcat:8.5.3:::::::*
cpe:2.3:a:apache:tomcat:8.5.6:::::::*
cpe:2.3:a:apache:tomcat:8.5.7:::::::*
cpe:2.3:a:apache:tomcat:8.5.8:::::::*
cpe:2.3:a:apache:tomcat:8.5.12:::::::*
cpe:2.3:a:apache:tomcat:8.5.11:::::::*
cpe:2.3:a:apache:tomcat:8.5.1:::::::*
cpe:2.3:a:apache:tomcat:8.5.16:::::::*
cpe:2.3:a:apache:tomcat:8.5.17:::::::*
cpe:2.3:a:apache:tomcat:8.5.18:::::::*
cpe:2.3:a:apache:tomcat:8.5.19:::::::*
cpe:2.3:a:apache:tomcat:8.5.20:::::::*
cpe:2.3:a:apache:tomcat:8.5.21:::::::*
cpe:2.3:a:apache:tomcat:8.5.22:::::::*
cpe:2.3:a:apache:tomcat:9.0.1:::::::*
cpe:2.3:a:apache:tomcat:9.0.2:::::::*
cpe:2.3:a:apache:tomcat:9.0.3:::::::*
cpe:2.3:a:apache:tomcat:9.0.4:::::::*
cpe:2.3:a:apache:tomcat:9.0.0:milestone10::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone11::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone12::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone13::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone14::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone15::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone16::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone17::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone18::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone19::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone20::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone21::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone22::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone23::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone24::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone25::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone26::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone27::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone5::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone6::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone7::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone8::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone9::::::
cpe:2.3:a:apache:tomcat:10.0.0:milestone3::::::
cpe:2.3:a:apache:tomcat:10.0.0:milestone4::::::
cpe:2.3:a:apache:tomcat:10.0.0:milestone2::::::
cpe:2.3:a:apache:tomcat:10.0.0:milestone1::::::
cpe:2.3:a:apache:tomcat:10.0.0:milestone5::::::
cpe:2.3:a:apache:tomcat:10.0.0:milestone6::::::
cpe:2.3:a:apache:tomcat:9.0.5:::::::*
cpe:2.3:a:apache:tomcat:9.0.6:::::::*
cpe:2.3:a:apache:tomcat:9.0.7:::::::*
cpe:2.3:a:apache:tomcat:9.0.8:::::::*
cpe:2.3:a:apache:tomcat:9.0.9:::::::*
cpe:2.3:a:apache:tomcat:9.0.10:::::::*
cpe:2.3:a:apache:tomcat:9.0.11:::::::*
cpe:2.3:a:apache:tomcat:9.0.12:::::::*
cpe:2.3:a:apache:tomcat:9.0.13:::::::*
cpe:2.3:a:apache:tomcat:9.0.14:::::::*
cpe:2.3:a:apache:tomcat:9.0.15:::::::*
cpe:2.3:a:apache:tomcat:9.0.16:::::::*
cpe:2.3:a:apache:tomcat:9.0.17:::::::*
cpe:2.3:a:apache:tomcat:9.0.18:::::::*
cpe:2.3:a:apache:tomcat:9.0.19:::::::*
cpe:2.3:a:apache:tomcat:9.0.20:::::::*
cpe:2.3:a:apache:tomcat:9.0.21:::::::*
cpe:2.3:a:apache:tomcat:9.0.22:::::::*
cpe:2.3:a:apache:tomcat:9.0.23:::::::*
cpe:2.3:a:apache:tomcat:9.0.24:::::::*
cpe:2.3:a:apache:tomcat:9.0.25:::::::*
cpe:2.3:a:apache:tomcat:9.0.26:::::::*
cpe:2.3:a:apache:tomcat:9.0.27:::::::*
cpe:2.3:a:apache:tomcat:9.0.28:::::::*
cpe:2.3:a:apache:tomcat:9.0.29:::::::*
cpe:2.3:a:apache:tomcat:9.0.30:::::::*
cpe:2.3:a:apache:tomcat:9.0.31:::::::*
cpe:2.3:a:apache:tomcat:9.0.32:::::::*
cpe:2.3:a:apache:tomcat:9.0.33:::::::*
cpe:2.3:a:apache:tomcat:9.0.34:::::::*
cpe:2.3:a:apache:tomcat:9.0.35:::::::*
cpe:2.3:a:apache:tomcat:9.0.36:::::::*
cpe:2.3:a:apache:tomcat:9.0.37:::::::*
cpe:2.3:a:apache:tomcat:10.0.0:milestone7::::::
cpe:2.3:a:apache:tomcat:8.5.23:::::::*
cpe:2.3:a:apache:tomcat:8.5.24:::::::*
cpe:2.3:a:apache:tomcat:8.5.25:::::::*
cpe:2.3:a:apache:tomcat:8.5.26:::::::*
cpe:2.3:a:apache:tomcat:8.5.27:::::::*
cpe:2.3:a:apache:tomcat:8.5.28:::::::*
cpe:2.3:a:apache:tomcat:8.5.29:::::::*
cpe:2.3:a:apache:tomcat:8.5.30:::::::*
cpe:2.3:a:apache:tomcat:8.5.31:::::::*
cpe:2.3:a:apache:tomcat:8.5.32:::::::*
cpe:2.3:a:apache:tomcat:8.5.33:::::::*
cpe:2.3:a:apache:tomcat:8.5.34:::::::*
cpe:2.3:a:apache:tomcat:8.5.35:::::::*
cpe:2.3:a:apache:tomcat:8.5.36:::::::*
cpe:2.3:a:apache:tomcat:8.5.37:::::::*
cpe:2.3:a:apache:tomcat:8.5.38:::::::*
cpe:2.3:a:apache:tomcat:8.5.39:::::::*
cpe:2.3:a:apache:tomcat:8.5.40:::::::*
cpe:2.3:a:apache:tomcat:8.5.41:::::::*
cpe:2.3:a:apache:tomcat:8.5.42:::::::*
cpe:2.3:a:apache:tomcat:8.5.43:::::::*
cpe:2.3:a:apache:tomcat:8.5.44:::::::*
cpe:2.3:a:apache:tomcat:8.5.45:::::::*
cpe:2.3:a:apache:tomcat:8.5.46:::::::*
cpe:2.3:a:apache:tomcat:8.5.47:::::::*
cpe:2.3:a:apache:tomcat:8.5.48:::::::*
cpe:2.3:a:apache:tomcat:8.5.49:::::::*
cpe:2.3:a:apache:tomcat:8.5.50:::::::*
cpe:2.3:a:apache:tomcat:8.5.51:::::::*
cpe:2.3:a:apache:tomcat:8.5.52:::::::*
cpe:2.3:a:apache:tomcat:8.5.53:::::::*
cpe:2.3:a:apache:tomcat:8.5.54:::::::*
cpe:2.3:a:apache:tomcat:8.5.55:::::::*
cpe:2.3:a:apache:tomcat:8.5.56:::::::*
cpe:2.3:a:apache:tomcat:8.5.57:::::::*

構成2	以上	以下	より上	未満
cpe:2.3:o:debian:debian_linux:9.0:::::::*
cpe:2.3:o:debian:debian_linux:10.0:::::::*

構成3	以上	以下	より上	未満
cpe:2.3:a:oracle:instantis_enterprisetrack:17.1:::::::*
cpe:2.3:a:oracle:instantis_enterprisetrack:17.2:::::::*
cpe:2.3:a:oracle:instantis_enterprisetrack:17.3:::::::*
cpe:2.3:a:oracle:sd-wan_edge:9.0:::::::*

関連情報、対策とツール

No	URL	タグ
1	http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00002.html	Mailing List Third Party Advisory
2	http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00021.html	Broken Link
3	https://lists.apache.org/thread.html/r4a390027eb27e4550142fac6c8317cc684b157ae314d31514747f307%40%3Cannounce.tomcat.apache.org%3E	Vendor Advisory
4	https://lists.debian.org/debian-lts-announce/2020/10/msg00019.html	Third Party Advisory
5	https://security.netapp.com/advisory/ntap-20201016-0007/	Third Party Advisory
6	https://www.debian.org/security/2021/dsa-4835	Third Party Advisory
7	https://www.oracle.com/security-alerts/cpuApr2021.html	Patch Third Party Advisory
8	http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00002.html	Mailing List Third Party Advisory
9	https://www.oracle.com/security-alerts/cpuApr2021.html	Patch Third Party Advisory
10	https://www.debian.org/security/2021/dsa-4835	Third Party Advisory
11	https://security.netapp.com/advisory/ntap-20201016-0007/	Third Party Advisory
12	https://lists.debian.org/debian-lts-announce/2020/10/msg00019.html	Third Party Advisory
13	https://lists.apache.org/thread.html/r4a390027eb27e4550142fac6c8317cc684b157ae314d31514747f307%40%3Cannounce.tomcat.apache.org%3E	Vendor Advisory
14	http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00021.html	Broken Link

共通脆弱性一覧

JVN脆弱性情報

Apache Tomcat における HTTP/2 リクエスト処理の不備に起因する情報漏えいの脆弱性

タイトル	Apache Tomcat における HTTP/2 リクエスト処理の不備に起因する情報漏えいの脆弱性
概要	Apache Tomcat には、 HTTP/2 リクエスト処理の不備に起因する情報漏えいの脆弱性が存在します。 The Apache Software Foundation から、Apache Tomcat の脆弱性に対するアップデートが公開されました。 * HTTP/2 リクエストの取り違え - CVE-2020-13943 HTTP/2 クライアントが接続許可された最大同時ストリーム数を超えた場合、その接続における後続のリクエストにおいて、意図した HTTP ヘッダではなく、以前送信されたリクエストの HTTP ヘッダに置き換わる可能性があります。その結果、ユーザが予期しないリソースへの応答が表示される可能性があります。
想定される影響	遠隔の第三者によって細工された HTTP/2 リクエストを送信され、予期しないリソースへの応答が表示されることで、機微な情報が取得される可能性があります。
対策	[アップデートする] 開発者が提供する情報をもとに、最新版へアップデートしてください。開発者は、本脆弱性の対策版として次のバージョンをリリースしています。　　* Apache Tomcat 10.0.0-M8 　　* Apache Tomcat 9.0.38 　　* Apache Tomcat 8.5.58
公表日	2020年10月14日0:00
登録日	2020年10月15日17:19
最終更新日	2021年8月10日17:25

影響を受けるシステム

Apache Software Foundation

Apache Tomcat 10.0.0-M1 から 10.0.0-M7 まで

Apache Tomcat 8.5.0 から 8.5.57 まで

Apache Tomcat 9.0.0.M1 から 9.0.37 まで

CVE (情報セキュリティ共通脆弱性識別子)

No	名前	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2020-13943	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13943
National Vulnerability Database (NVD)
2	CVE-2020-13943	https://nvd.nist.gov/vuln/detail/CVE-2020-13943

ベンダー情報

No	名前	URL
Apache Software Foundation
1	Fixed in Apache Tomcat 10.0.0-M8	http://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.0.0-M8
2	Fixed in Apache Tomcat 8.5.58	http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.58
3	Fixed in Apache Tomcat 9.0.38	http://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.38
NEC製品セキュリティ情報
4	Apache Tomcat における HTTP/2 リクエスト処理の不備に起因する情報漏えいの脆弱性	https://jpn.nec.com/security-info/secinfo/nv20-016.html

その他

No	名前	URL
JVN
1	JVNVU#97307781	https://jvn.jp/vu/JVNVU97307781/index.html

変更履歴

No	変更内容	変更日
1	[2020年10月15日] 掲載	2020年10月15日17:19
2	[2021年08月10日] ベンダ情報：日本電気 (Apache Tomcat における HTTP/2 リクエスト処理の不備に起因する情報漏えいの脆弱性) を追加	2021年8月10日16:20

構成1	以上	以下	より上	未満
cpe:2.3:a:apache:tomcat:8.5.2:::::::*
cpe:2.3:a:apache:tomcat:8.5.9:::::::*
cpe:2.3:a:apache:tomcat:8.5.4:::::::*
cpe:2.3:a:apache:tomcat:8.5.0:::::::*
cpe:2.3:a:apache:tomcat:8.5.15:::::::*
cpe:2.3:a:apache:tomcat:8.5.10:::::::*
cpe:2.3:a:apache:tomcat:8.5.13:::::::*
cpe:2.3:a:apache:tomcat:8.5.14:::::::*
cpe:2.3:a:apache:tomcat:8.5.5:::::::*
cpe:2.3:a:apache:tomcat:8.5.3:::::::*
cpe:2.3:a:apache:tomcat:8.5.6:::::::*
cpe:2.3:a:apache:tomcat:8.5.7:::::::*
cpe:2.3:a:apache:tomcat:8.5.8:::::::*
cpe:2.3:a:apache:tomcat:8.5.12:::::::*
cpe:2.3:a:apache:tomcat:8.5.11:::::::*
cpe:2.3:a:apache:tomcat:8.5.1:::::::*
cpe:2.3:a:apache:tomcat:8.5.16:::::::*
cpe:2.3:a:apache:tomcat:8.5.17:::::::*
cpe:2.3:a:apache:tomcat:8.5.18:::::::*
cpe:2.3:a:apache:tomcat:8.5.19:::::::*
cpe:2.3:a:apache:tomcat:8.5.20:::::::*
cpe:2.3:a:apache:tomcat:8.5.21:::::::*
cpe:2.3:a:apache:tomcat:8.5.22:::::::*
cpe:2.3:a:apache:tomcat:9.0.1:::::::*
cpe:2.3:a:apache:tomcat:9.0.2:::::::*
cpe:2.3:a:apache:tomcat:9.0.3:::::::*
cpe:2.3:a:apache:tomcat:9.0.4:::::::*
cpe:2.3:a:apache:tomcat:9.0.0:milestone10::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone11::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone12::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone13::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone14::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone15::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone16::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone17::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone18::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone19::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone20::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone21::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone22::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone23::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone24::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone25::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone26::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone27::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone5::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone6::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone7::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone8::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone9::::::
cpe:2.3:a:apache:tomcat:10.0.0:milestone3::::::
cpe:2.3:a:apache:tomcat:10.0.0:milestone4::::::
cpe:2.3:a:apache:tomcat:10.0.0:milestone2::::::
cpe:2.3:a:apache:tomcat:10.0.0:milestone1::::::
cpe:2.3:a:apache:tomcat:10.0.0:milestone5::::::
cpe:2.3:a:apache:tomcat:10.0.0:milestone6::::::
cpe:2.3:a:apache:tomcat:9.0.5:::::::*
cpe:2.3:a:apache:tomcat:9.0.6:::::::*
cpe:2.3:a:apache:tomcat:9.0.7:::::::*
cpe:2.3:a:apache:tomcat:9.0.8:::::::*
cpe:2.3:a:apache:tomcat:9.0.9:::::::*
cpe:2.3:a:apache:tomcat:9.0.10:::::::*
cpe:2.3:a:apache:tomcat:9.0.11:::::::*
cpe:2.3:a:apache:tomcat:9.0.12:::::::*
cpe:2.3:a:apache:tomcat:9.0.13:::::::*
cpe:2.3:a:apache:tomcat:9.0.14:::::::*
cpe:2.3:a:apache:tomcat:9.0.15:::::::*
cpe:2.3:a:apache:tomcat:9.0.16:::::::*
cpe:2.3:a:apache:tomcat:9.0.17:::::::*
cpe:2.3:a:apache:tomcat:9.0.18:::::::*
cpe:2.3:a:apache:tomcat:9.0.19:::::::*
cpe:2.3:a:apache:tomcat:9.0.20:::::::*
cpe:2.3:a:apache:tomcat:9.0.21:::::::*
cpe:2.3:a:apache:tomcat:9.0.22:::::::*
cpe:2.3:a:apache:tomcat:9.0.23:::::::*
cpe:2.3:a:apache:tomcat:9.0.24:::::::*
cpe:2.3:a:apache:tomcat:9.0.25:::::::*
cpe:2.3:a:apache:tomcat:9.0.26:::::::*
cpe:2.3:a:apache:tomcat:9.0.27:::::::*
cpe:2.3:a:apache:tomcat:9.0.28:::::::*
cpe:2.3:a:apache:tomcat:9.0.29:::::::*
cpe:2.3:a:apache:tomcat:9.0.30:::::::*
cpe:2.3:a:apache:tomcat:9.0.31:::::::*
cpe:2.3:a:apache:tomcat:9.0.32:::::::*
cpe:2.3:a:apache:tomcat:9.0.33:::::::*
cpe:2.3:a:apache:tomcat:9.0.34:::::::*
cpe:2.3:a:apache:tomcat:9.0.35:::::::*
cpe:2.3:a:apache:tomcat:9.0.36:::::::*
cpe:2.3:a:apache:tomcat:9.0.37:::::::*
cpe:2.3:a:apache:tomcat:10.0.0:milestone7::::::
cpe:2.3:a:apache:tomcat:8.5.23:::::::*
cpe:2.3:a:apache:tomcat:8.5.24:::::::*
cpe:2.3:a:apache:tomcat:8.5.25:::::::*
cpe:2.3:a:apache:tomcat:8.5.26:::::::*
cpe:2.3:a:apache:tomcat:8.5.27:::::::*
cpe:2.3:a:apache:tomcat:8.5.28:::::::*
cpe:2.3:a:apache:tomcat:8.5.29:::::::*
cpe:2.3:a:apache:tomcat:8.5.30:::::::*
cpe:2.3:a:apache:tomcat:8.5.31:::::::*
cpe:2.3:a:apache:tomcat:8.5.32:::::::*
cpe:2.3:a:apache:tomcat:8.5.33:::::::*
cpe:2.3:a:apache:tomcat:8.5.34:::::::*
cpe:2.3:a:apache:tomcat:8.5.35:::::::*
cpe:2.3:a:apache:tomcat:8.5.36:::::::*
cpe:2.3:a:apache:tomcat:8.5.37:::::::*
cpe:2.3:a:apache:tomcat:8.5.38:::::::*
cpe:2.3:a:apache:tomcat:8.5.39:::::::*
cpe:2.3:a:apache:tomcat:8.5.40:::::::*
cpe:2.3:a:apache:tomcat:8.5.41:::::::*
cpe:2.3:a:apache:tomcat:8.5.42:::::::*
cpe:2.3:a:apache:tomcat:8.5.43:::::::*
cpe:2.3:a:apache:tomcat:8.5.44:::::::*
cpe:2.3:a:apache:tomcat:8.5.45:::::::*
cpe:2.3:a:apache:tomcat:8.5.46:::::::*
cpe:2.3:a:apache:tomcat:8.5.47:::::::*
cpe:2.3:a:apache:tomcat:8.5.48:::::::*
cpe:2.3:a:apache:tomcat:8.5.49:::::::*
cpe:2.3:a:apache:tomcat:8.5.50:::::::*
cpe:2.3:a:apache:tomcat:8.5.51:::::::*
cpe:2.3:a:apache:tomcat:8.5.52:::::::*
cpe:2.3:a:apache:tomcat:8.5.53:::::::*
cpe:2.3:a:apache:tomcat:8.5.54:::::::*
cpe:2.3:a:apache:tomcat:8.5.55:::::::*
cpe:2.3:a:apache:tomcat:8.5.56:::::::*
cpe:2.3:a:apache:tomcat:8.5.57:::::::*