CVE:CVE-2020-13935
CNNVD:CNNVD-202007-571
Apache Tomcat是美国阿帕奇（Apache）基金会的一款轻量级Web应用服务器。该程序实现了对Servlet和JavaServer Page（JSP）的支持。
Apache Tomcat中的WebSocket存在安全漏洞，该漏洞源于程序没有正确验证payload的长度。攻击者可利用该漏洞造成拒绝服务（无限循环）。以下产品及版本受到影响：Apache Tomcat 10.0.0-M1版本至10.0.0-M6版本，9.0.0.M1版本至9.0.36版本，8.5.0版本至8.5.56版本，7.0.27版本至7.0.104版本。
solution:Upgrade apache tomcat to a higher version than 7.0.104,8.5.56,9.0.36,9.0.0:milestone1,9.0.0:milestone10,9.0.0:milestone11,9.0.0:milestone12,9.0.0:milestone13,9.0.0:milestone14,9.0.0:milestone15,9.0.0:milestone16,9.0.0:milestone17,9.0.0:milestone18,9.0.0:milestone19,9.0.0:milestone2,9.0.0:milestone20,9.0.0:milestone21,9.0.0:milestone22,9.0.0:milestone23,9.0.0:milestone24,9.0.0:milestone25,9.0.0:milestone26,9.0.0:milestone27,9.0.0:milestone3,9.0.0:milestone4,9.0.0:milestone5,9.0.0:milestone6,9.0.0:milestone7,9.0.0:milestone8,9.0.0:milestone9,10.0.0:milestone1,10.0.0:milestone2,10.0.0:milestone3,10.0.0:milestone4,10.0.0:milestone5,10.0.0:milestone6,and avoid the version [7.0.27,7.0.104],[8.5.0,8.5.56],[9.0.1,9.0.36],9.0.0:milestone1,9.0.0:milestone10,9.0.0:milestone11,9.0.0:milestone12,9.0.0:milestone13,9.0.0:milestone14,9.0.0:milestone15,9.0.0:milestone16,9.0.0:milestone17,9.0.0:milestone18,9.0.0:milestone19,9.0.0:milestone2,9.0.0:milestone20,9.0.0:milestone21,9.0.0:milestone22,9.0.0:milestone23,9.0.0:milestone24,9.0.0:milestone25,9.0.0:milestone26,9.0.0:milestone27,9.0.0:milestone3,9.0.0:milestone4,9.0.0:milestone5,9.0.0:milestone6,9.0.0:milestone7,9.0.0:milestone8,9.0.0:milestone9,10.0.0:milestone1,10.0.0:milestone2,10.0.0:milestone3,10.0.0:milestone4,10.0.0:milestone5,10.0.0:milestone6; Upgrade debian debian_linux to a higher version than 9.0,10.0,and avoid the version 9.0,10.0; Upgrade netapp oncommand_system_manager to a higher version than 3.1.3,and avoid the version [3.0.0,3.1.3]; Upgrade opensuse leap to a higher version than 15.1,15.2,and avoid the version 15.1,15.2; Upgrade canonical ubuntu_linux to a higher version than 16.04,20.04,and avoid the version 16.04,20.04; Upgrade mcafee epolicy_orchestrator to a higher version than 5.9.0,5.9.1,5.10.0,5.10.0:update_1,5.10.0:update_2,5.10.0:update_3,5.10.0:update_4,5.10.0:update_5,5.10.0:update_6,5.10.0:update_7,5.10.0:update_8,and avoid the version 5.9.0,5.9.1,5.10.0,5.10.0:update_1,5.10.0:update_2,5.10.0:update_3,5.10.0:update_4,5.10.0:update_5,5.10.0:update_6,5.10.0:update_7,5.10.0:update_8; Upgrade oracle agile_engineering_data_management to a higher version than 6.2.1.0,and avoid the version 6.2.1.0; Upgrade oracle agile_plm to a higher version than 9.3.3,9.3.5,9.3.6,and avoid the version 9.3.3,9.3.5,9.3.6; Upgrade oracle blockchain_platform to a higher version than 21.1.2,and avoid the version (,21.1.2); Upgrade oracle commerce_guided_search to a higher version than 11.3.2,and avoid the version 11.3.2; Upgrade oracle communications_cloud_native_core_policy to a higher version than 1.14.0,and avoid the version 1.14.0; Upgrade oracle communications_instant_messaging_server to a higher version than 10.0.1.5.0,and avoid the version 10.0.1.5.0; Upgrade oracle fmw_platform to a higher version than 12.2.1.3.0,12.2.1.4.0,and avoid the version 12.2.1.3.0,12.2.1.4.0; Upgrade oracle instantis_enterprisetrack to a higher version than 17.1,17.2,17.3,and avoid the version 17.1,17.2,17.3; Upgrade oracle managed_file_transfer to a higher version than 12.2.1.3.0,12.2.1.4.0,and avoid the version 12.2.1.3.0,12.2.1.4.0; Upgrade oracle mysql_enterprise_monitor to a higher version than 8.0.21,and avoid the version (,8.0.21]; Upgrade oracle siebel_ui_framework to a higher version than 20.12,and avoid the version (,20.12]; Upgrade oracle workload_manager to a higher version than 12.2.0.1,18c,19c,and avoid the version 12.2.0.1,18c,19c