RHSA-2024:3814
Vulnerability from csaf_redhat - Published: 2024-06-11 17:34 - Updated: 2026-09-28 09:38Summary
Red Hat Security Advisory: tomcat security and bug fix update
Severity
Important
Notes
Topic: An update for tomcat is now available for Red Hat Enterprise Linux 8.8 Extended Update Support.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.
Security Fix(es):
* Apache Tomcat: HTTP/2 header handling DoS (CVE-2024-24549)
* Apache Tomcat: WebSocket DoS with incomplete closing handshake (CVE-2024-23672)
Bug Fix(es):
* Rebase tomcat to version 9.0.87 (JIRA:RHEL-34811)
* Amend tomcat package's changelog so that fixed CVEs are mentioned explicitly (JIRA:RHEL-37865)
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in the Tomcat package. This flaw allowed users to input an invalid JSON structure, causing unwanted behavior as it did not escape the type, message, or description values.
7.5 (High)
Affected products
Fixed
9 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-8.8.0.Z.EUS:tomcat-1:9.0.87-1.el8_8.2.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.8.0.Z.EUS:tomcat-1:9.0.87-1.el8_8.2.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.8.0.Z.EUS:tomcat-admin-webapps-1:9.0.87-1.el8_8.2.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.8.0.Z.EUS:tomcat-docs-webapp-1:9.0.87-1.el8_8.2.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.8.0.Z.EUS:tomcat-el-3.0-api-1:9.0.87-1.el8_8.2.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.8.0.Z.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.2.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.8.0.Z.EUS:tomcat-lib-1:9.0.87-1.el8_8.2.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.8.0.Z.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.2.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.8.0.Z.EUS:tomcat-webapps-1:9.0.87-1.el8_8.2.noarch | — |
Vendor Fix
fix
|
Threats
Impact
Low
A flaw was found in Apache Commons FileUpload, where it does not limit the number of parts being processed in a request. This issue may allow an attacker to use a malicious upload or series of uploads to trigger a denial of service. While Red Hat Satellite relies upon Apache Tomcat, it does not directly ship it. Tomcat is shipped with Red Hat Enterprise Linux and consumed by the Candlepin component of Satellite. Red Hat Satellite users are therefore advised to check the impact state of Red Hat Enterprise Linux, since any necessary fixes will be distributed through the platform.
6.5 (Medium)
Affected products
Fixed
9 products, the same list as for
CVE-2022-45143
Threats
Impact
Moderate
When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat 11.0.0-M1 to 11.0.0.-M2, 10.1.0-M1 to 10.1.5, 9.0.0-M1 to 9.0.71 and 8.5.0 to 8.5.85 did not include the secure attribute. This could result in the user agent transmitting the session cookie over an insecure channel. Older, EOL versions may also be affected.
4.3 (Medium)
Affected products
Fixed
9 products, the same list as for
CVE-2022-45143
Threats
Impact
Moderate
A flaw was found in Apache Tomcat if the default web application is configured with FormAuthenticator. This issue allows a specially crafted URL to trigger a redirect to an arbitrary URL.
6.1 (Medium)
Affected products
Fixed
9 products, the same list as for
CVE-2022-45143
Threats
Impact
Moderate
A flaw was found in Apache Tomcat. Tomcat may skip, after an error, the recycling of the internal objects that the next request/response process might use, resulting in information leaking from one request to the next. This flaw allows a malicious user to have access to this information.
5.3 (Medium)
Affected products
Fixed
9 products, the same list as for
CVE-2022-45143
Threats
Impact
Moderate
A flaw was found in Apache Tomcat, where an improper input validation can occur. This flaw allows a malicious user to send a crafted request containing an invalid trailer header, which could be treated as multiple requests, potentially leading to request smuggling when behind a reverse proxy.
5.3 (Medium)
Affected products
Fixed
9 products, the same list as for
CVE-2022-45143
Threats
Impact
Moderate
A denial of service (DoS) vulnerability present in the Apache Tomcat package arises from an incomplete cleanup process. Specifically, WebSocket clients can perpetuate WebSocket connections without proper termination, thereby causing a sustained drain on system resources. This vulnerability facilitates the exploitation of Apache Tomcat servers, leading to a scenario where excessive resource consumption occurs due to the prolonged existence of these open WebSocket connections. As a consequence, the server's performance may degrade significantly, resulting in potential service disruption or unresponsiveness.
7.5 (High)
Affected products
Fixed
9 products, the same list as for
CVE-2022-45143
Threats
Impact
Important
A vulnerability was found in the Tomcat package due to its handling of HTTP/2 requests. Specifically, when an HTTP/2 request surpasses the predetermined limits for headers configured within the server, the associated HTTP/2 stream isn't reset immediately. Instead, the reset action occurs only after all the headers within the request have been processed. This lapse in resetting the stream exposes the system to potential risks, as it allows malicious actors to exploit the delay in stream reset to carry out various attacks, such as header manipulation or resource exhaustion.
7.5 (High)
Affected products
Fixed
9 products, the same list as for
CVE-2022-45143
Threats
Impact
Important
References
48 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for tomcat is now available for Red Hat Enterprise Linux 8.8 Extended Update Support.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.\n\nSecurity Fix(es):\n\n* Apache Tomcat: HTTP/2 header handling DoS (CVE-2024-24549)\n\n* Apache Tomcat: WebSocket DoS with incomplete closing handshake (CVE-2024-23672)\n\nBug Fix(es):\n\n* Rebase tomcat to version 9.0.87 (JIRA:RHEL-34811)\n\n* Amend tomcat package\u0027s changelog so that fixed CVEs are mentioned explicitly (JIRA:RHEL-37865)",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2024:3814",
"url": "https://access.redhat.com/errata/RHSA-2024:3814"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2269607",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2269607"
},
{
"category": "external",
"summary": "2269608",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2269608"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_3814.json"
}
],
"title": "Red Hat Security Advisory: tomcat security and bug fix update",
"tracking": {
"current_release_date": "2026-09-28T09:38:15+00:00",
"generator": {
"date": "2026-09-28T09:38:15+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.4.0"
}
},
"id": "RHSA-2024:3814",
"initial_release_date": "2024-06-11T17:34:47+00:00",
"revision_history": [
{
"date": "2024-06-11T17:34:47+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2024-06-11T17:34:47+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-09-28T09:38:15+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream EUS (v.8.8)",
"product": {
"name": "Red Hat Enterprise Linux AppStream EUS (v.8.8)",
"product_id": "AppStream-8.8.0.Z.EUS",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_eus:8.8::appstream"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "tomcat-1:9.0.87-1.el8_8.2.src",
"product": {
"name": "tomcat-1:9.0.87-1.el8_8.2.src",
"product_id": "tomcat-1:9.0.87-1.el8_8.2.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat@9.0.87-1.el8_8.2?arch=src\u0026epoch=1"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "tomcat-1:9.0.87-1.el8_8.2.noarch",
"product": {
"name": "tomcat-1:9.0.87-1.el8_8.2.noarch",
"product_id": "tomcat-1:9.0.87-1.el8_8.2.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat@9.0.87-1.el8_8.2?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "tomcat-admin-webapps-1:9.0.87-1.el8_8.2.noarch",
"product": {
"name": "tomcat-admin-webapps-1:9.0.87-1.el8_8.2.noarch",
"product_id": "tomcat-admin-webapps-1:9.0.87-1.el8_8.2.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat-admin-webapps@9.0.87-1.el8_8.2?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "tomcat-docs-webapp-1:9.0.87-1.el8_8.2.noarch",
"product": {
"name": "tomcat-docs-webapp-1:9.0.87-1.el8_8.2.noarch",
"product_id": "tomcat-docs-webapp-1:9.0.87-1.el8_8.2.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat-docs-webapp@9.0.87-1.el8_8.2?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "tomcat-el-3.0-api-1:9.0.87-1.el8_8.2.noarch",
"product": {
"name": "tomcat-el-3.0-api-1:9.0.87-1.el8_8.2.noarch",
"product_id": "tomcat-el-3.0-api-1:9.0.87-1.el8_8.2.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat-el-3.0-api@9.0.87-1.el8_8.2?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.2.noarch",
"product": {
"name": "tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.2.noarch",
"product_id": "tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.2.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat-jsp-2.3-api@9.0.87-1.el8_8.2?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "tomcat-lib-1:9.0.87-1.el8_8.2.noarch",
"product": {
"name": "tomcat-lib-1:9.0.87-1.el8_8.2.noarch",
"product_id": "tomcat-lib-1:9.0.87-1.el8_8.2.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat-lib@9.0.87-1.el8_8.2?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.2.noarch",
"product": {
"name": "tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.2.noarch",
"product_id": "tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.2.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat-servlet-4.0-api@9.0.87-1.el8_8.2?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "tomcat-webapps-1:9.0.87-1.el8_8.2.noarch",
"product": {
"name": "tomcat-webapps-1:9.0.87-1.el8_8.2.noarch",
"product_id": "tomcat-webapps-1:9.0.87-1.el8_8.2.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat-webapps@9.0.87-1.el8_8.2?arch=noarch\u0026epoch=1"
}
}
}
],
"category": "architecture",
"name": "noarch"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-1:9.0.87-1.el8_8.2.noarch as a component of Red Hat Enterprise Linux AppStream EUS (v.8.8)",
"product_id": "AppStream-8.8.0.Z.EUS:tomcat-1:9.0.87-1.el8_8.2.noarch"
},
"product_reference": "tomcat-1:9.0.87-1.el8_8.2.noarch",
"relates_to_product_reference": "AppStream-8.8.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-1:9.0.87-1.el8_8.2.src as a component of Red Hat Enterprise Linux AppStream EUS (v.8.8)",
"product_id": "AppStream-8.8.0.Z.EUS:tomcat-1:9.0.87-1.el8_8.2.src"
},
"product_reference": "tomcat-1:9.0.87-1.el8_8.2.src",
"relates_to_product_reference": "AppStream-8.8.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-admin-webapps-1:9.0.87-1.el8_8.2.noarch as a component of Red Hat Enterprise Linux AppStream EUS (v.8.8)",
"product_id": "AppStream-8.8.0.Z.EUS:tomcat-admin-webapps-1:9.0.87-1.el8_8.2.noarch"
},
"product_reference": "tomcat-admin-webapps-1:9.0.87-1.el8_8.2.noarch",
"relates_to_product_reference": "AppStream-8.8.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-docs-webapp-1:9.0.87-1.el8_8.2.noarch as a component of Red Hat Enterprise Linux AppStream EUS (v.8.8)",
"product_id": "AppStream-8.8.0.Z.EUS:tomcat-docs-webapp-1:9.0.87-1.el8_8.2.noarch"
},
"product_reference": "tomcat-docs-webapp-1:9.0.87-1.el8_8.2.noarch",
"relates_to_product_reference": "AppStream-8.8.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-el-3.0-api-1:9.0.87-1.el8_8.2.noarch as a component of Red Hat Enterprise Linux AppStream EUS (v.8.8)",
"product_id": "AppStream-8.8.0.Z.EUS:tomcat-el-3.0-api-1:9.0.87-1.el8_8.2.noarch"
},
"product_reference": "tomcat-el-3.0-api-1:9.0.87-1.el8_8.2.noarch",
"relates_to_product_reference": "AppStream-8.8.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.2.noarch as a component of Red Hat Enterprise Linux AppStream EUS (v.8.8)",
"product_id": "AppStream-8.8.0.Z.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.2.noarch"
},
"product_reference": "tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.2.noarch",
"relates_to_product_reference": "AppStream-8.8.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-lib-1:9.0.87-1.el8_8.2.noarch as a component of Red Hat Enterprise Linux AppStream EUS (v.8.8)",
"product_id": "AppStream-8.8.0.Z.EUS:tomcat-lib-1:9.0.87-1.el8_8.2.noarch"
},
"product_reference": "tomcat-lib-1:9.0.87-1.el8_8.2.noarch",
"relates_to_product_reference": "AppStream-8.8.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.2.noarch as a component of Red Hat Enterprise Linux AppStream EUS (v.8.8)",
"product_id": "AppStream-8.8.0.Z.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.2.noarch"
},
"product_reference": "tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.2.noarch",
"relates_to_product_reference": "AppStream-8.8.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-webapps-1:9.0.87-1.el8_8.2.noarch as a component of Red Hat Enterprise Linux AppStream EUS (v.8.8)",
"product_id": "AppStream-8.8.0.Z.EUS:tomcat-webapps-1:9.0.87-1.el8_8.2.noarch"
},
"product_reference": "tomcat-webapps-1:9.0.87-1.el8_8.2.noarch",
"relates_to_product_reference": "AppStream-8.8.0.Z.EUS"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2022-45143",
"cwe": {
"id": "CWE-74",
"name": "Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)"
},
"discovery_date": "2023-01-06T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2158695"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Tomcat package. This flaw allowed users to input an invalid JSON structure, causing unwanted behavior as it did not escape the type, message, or description values.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: JsonErrorReportValve injection",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Although it may be rated as CVSS 7.5, it\u0027s still considered a low impact flaw as according to the advisory report from Apache, user controlled data may occur in specific cases only and may alter some specific fields only.\n\nRed Hat Satellite does not include the affected Apache Tomcat, however, Tomcat is shipped with Red Hat Enterprise Linux and consumed by the Candlepin component of Satellite. Red Hat Satellite users are therefore advised to check the impact state of Red Hat Enterprise Linux, since any necessary fixes will be distributed through the platform.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.8.0.Z.EUS:tomcat-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-1:9.0.87-1.el8_8.2.src",
"AppStream-8.8.0.Z.EUS:tomcat-admin-webapps-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-docs-webapp-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-el-3.0-api-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-lib-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-webapps-1:9.0.87-1.el8_8.2.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2022-45143"
},
{
"category": "external",
"summary": "RHBZ#2158695",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2158695"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2022-45143",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-45143"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-45143",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-45143"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/yqkd183xrw3wqvnpcg3osbcryq85fkzj",
"url": "https://lists.apache.org/thread/yqkd183xrw3wqvnpcg3osbcryq85fkzj"
}
],
"release_date": "2023-01-03T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2024-06-11T17:34:47+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.8.0.Z.EUS:tomcat-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-1:9.0.87-1.el8_8.2.src",
"AppStream-8.8.0.Z.EUS:tomcat-admin-webapps-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-docs-webapp-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-el-3.0-api-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-lib-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-webapps-1:9.0.87-1.el8_8.2.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2024:3814"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"AppStream-8.8.0.Z.EUS:tomcat-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-1:9.0.87-1.el8_8.2.src",
"AppStream-8.8.0.Z.EUS:tomcat-admin-webapps-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-docs-webapp-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-el-3.0-api-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-lib-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-webapps-1:9.0.87-1.el8_8.2.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "tomcat: JsonErrorReportValve injection"
},
{
"cve": "CVE-2023-24998",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2023-02-20T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2172298"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Commons FileUpload, where it does not limit the number of parts being processed in a request. This issue may allow an attacker to use a malicious upload or series of uploads to trigger a denial of service.\r\n\r\nWhile Red Hat Satellite relies upon Apache Tomcat, it does not directly ship it. Tomcat is shipped with Red Hat Enterprise Linux and consumed by the Candlepin component of Satellite. Red Hat Satellite users are therefore advised to check the impact state of Red Hat Enterprise Linux, since any necessary fixes will be distributed through the platform.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "FileUpload: FileUpload DoS with excessive parts",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.8.0.Z.EUS:tomcat-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-1:9.0.87-1.el8_8.2.src",
"AppStream-8.8.0.Z.EUS:tomcat-admin-webapps-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-docs-webapp-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-el-3.0-api-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-lib-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-webapps-1:9.0.87-1.el8_8.2.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2023-24998"
},
{
"category": "external",
"summary": "RHBZ#2172298",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2172298"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2023-24998",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-24998"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-24998",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-24998"
},
{
"category": "external",
"summary": "https://commons.apache.org/proper/commons-fileupload/security-reports.html#Fixed_in_Apache_Commons_FileUpload_1.5",
"url": "https://commons.apache.org/proper/commons-fileupload/security-reports.html#Fixed_in_Apache_Commons_FileUpload_1.5"
}
],
"release_date": "2023-02-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2024-06-11T17:34:47+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.8.0.Z.EUS:tomcat-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-1:9.0.87-1.el8_8.2.src",
"AppStream-8.8.0.Z.EUS:tomcat-admin-webapps-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-docs-webapp-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-el-3.0-api-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-lib-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-webapps-1:9.0.87-1.el8_8.2.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2024:3814"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.8.0.Z.EUS:tomcat-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-1:9.0.87-1.el8_8.2.src",
"AppStream-8.8.0.Z.EUS:tomcat-admin-webapps-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-docs-webapp-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-el-3.0-api-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-lib-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-webapps-1:9.0.87-1.el8_8.2.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "FileUpload: FileUpload DoS with excessive parts"
},
{
"cve": "CVE-2023-28708",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"discovery_date": "2023-03-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2180856"
}
],
"notes": [
{
"category": "description",
"text": "When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat 11.0.0-M1 to 11.0.0.-M2, 10.1.0-M1 to 10.1.5, 9.0.0-M1 to 9.0.71 and 8.5.0 to 8.5.85 did not\u00a0include the secure attribute. This could result in the user agent\u00a0transmitting the session cookie over an insecure channel.\n\nOlder, EOL versions may also be affected.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: not including the secure attribute causes information disclosure",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "CVE-2023-28708 only potentially impacts a Tomcat configuration using a RemoteIpFilter behind a proxy or loadbalancer that sets an X-Forwarded-Proto request header with a value of https. If you do not use RemoteIpFilter in such a configuration, then the vulnerability would not have any impact on you\n\nRed Hat Satellite does not include the affected Apache Tomcat, however, Tomcat is shipped with Red Hat Enterprise Linux and consumed by the Candlepin component of Satellite. Red Hat Satellite users are therefore advised to check the impact state of Red Hat Enterprise Linux, since any necessary fixes will be distributed through the platform.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.8.0.Z.EUS:tomcat-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-1:9.0.87-1.el8_8.2.src",
"AppStream-8.8.0.Z.EUS:tomcat-admin-webapps-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-docs-webapp-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-el-3.0-api-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-lib-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-webapps-1:9.0.87-1.el8_8.2.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2023-28708"
},
{
"category": "external",
"summary": "RHBZ#2180856",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2180856"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2023-28708",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-28708"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-28708",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-28708"
},
{
"category": "external",
"summary": "https://bz.apache.org/bugzilla/show_bug.cgi?id=66471",
"url": "https://bz.apache.org/bugzilla/show_bug.cgi?id=66471"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/hdksc59z3s7tm39x0pp33mtwdrt8qr67",
"url": "https://lists.apache.org/thread/hdksc59z3s7tm39x0pp33mtwdrt8qr67"
}
],
"release_date": "2023-03-22T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2024-06-11T17:34:47+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.8.0.Z.EUS:tomcat-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-1:9.0.87-1.el8_8.2.src",
"AppStream-8.8.0.Z.EUS:tomcat-admin-webapps-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-docs-webapp-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-el-3.0-api-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-lib-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-webapps-1:9.0.87-1.el8_8.2.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2024:3814"
},
{
"category": "workaround",
"details": "For possible impact and workaround, please refer to: https://access.redhat.com/solutions/7004796",
"product_ids": [
"AppStream-8.8.0.Z.EUS:tomcat-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-1:9.0.87-1.el8_8.2.src",
"AppStream-8.8.0.Z.EUS:tomcat-admin-webapps-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-docs-webapp-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-el-3.0-api-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-lib-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-webapps-1:9.0.87-1.el8_8.2.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"AppStream-8.8.0.Z.EUS:tomcat-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-1:9.0.87-1.el8_8.2.src",
"AppStream-8.8.0.Z.EUS:tomcat-admin-webapps-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-docs-webapp-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-el-3.0-api-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-lib-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-webapps-1:9.0.87-1.el8_8.2.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "tomcat: not including the secure attribute causes information disclosure"
},
{
"cve": "CVE-2023-41080",
"cwe": {
"id": "CWE-601",
"name": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)"
},
"discovery_date": "2023-08-28T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2235370"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Tomcat if the default web application is configured with FormAuthenticator. This issue allows a specially crafted URL to trigger a redirect to an arbitrary URL.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: Open Redirect vulnerability in FORM authentication",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The pki-servlet-engine package has been obsoleted by the Tomcat package. Therefore, this issue will be fixed in the Tomcat package rather than the pki-serlvet-engine package. Please follow the RHEL Tomcat trackers instead for the updates.\n\nRed Hat Satellite is not directly impacted by this issue, since it does not embed the dependency on their offer deliveries. However, end users of Red Hat Satellite are using Tomcat via RHEL channels, which provides Tomcat dependency needed by candlepin to function in Satellite.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.8.0.Z.EUS:tomcat-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-1:9.0.87-1.el8_8.2.src",
"AppStream-8.8.0.Z.EUS:tomcat-admin-webapps-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-docs-webapp-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-el-3.0-api-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-lib-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-webapps-1:9.0.87-1.el8_8.2.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2023-41080"
},
{
"category": "external",
"summary": "RHBZ#2235370",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2235370"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2023-41080",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-41080"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-41080",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-41080"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/71wvwprtx2j2m54fovq9zr7gbm2wow2f",
"url": "https://lists.apache.org/thread/71wvwprtx2j2m54fovq9zr7gbm2wow2f"
}
],
"release_date": "2023-08-28T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2024-06-11T17:34:47+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.8.0.Z.EUS:tomcat-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-1:9.0.87-1.el8_8.2.src",
"AppStream-8.8.0.Z.EUS:tomcat-admin-webapps-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-docs-webapp-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-el-3.0-api-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-lib-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-webapps-1:9.0.87-1.el8_8.2.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2024:3814"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"AppStream-8.8.0.Z.EUS:tomcat-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-1:9.0.87-1.el8_8.2.src",
"AppStream-8.8.0.Z.EUS:tomcat-admin-webapps-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-docs-webapp-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-el-3.0-api-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-lib-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-webapps-1:9.0.87-1.el8_8.2.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "tomcat: Open Redirect vulnerability in FORM authentication"
},
{
"cve": "CVE-2023-42795",
"cwe": {
"id": "CWE-459",
"name": "Incomplete Cleanup"
},
"discovery_date": "2023-10-12T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2243752"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Tomcat. Tomcat may skip, after an error, the recycling of the internal objects that the next request/response process might use, resulting in information leaking from one request to the next. This flaw allows a malicious user to have access to this information.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: improper cleaning of recycled objects could lead to information leak",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this as a Moderate impact as the confidentiality is not fully compromised and the malicious user does not have confirmation over the scenario to replicate the error and capture the possible jeopardizing response.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.8.0.Z.EUS:tomcat-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-1:9.0.87-1.el8_8.2.src",
"AppStream-8.8.0.Z.EUS:tomcat-admin-webapps-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-docs-webapp-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-el-3.0-api-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-lib-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-webapps-1:9.0.87-1.el8_8.2.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2023-42795"
},
{
"category": "external",
"summary": "RHBZ#2243752",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2243752"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2023-42795",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-42795"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-42795",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-42795"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2023/10/10/9",
"url": "http://www.openwall.com/lists/oss-security/2023/10/10/9"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/065jfyo583490r9j2v73nhpyxdob56lw",
"url": "https://lists.apache.org/thread/065jfyo583490r9j2v73nhpyxdob56lw"
}
],
"release_date": "2023-10-10T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2024-06-11T17:34:47+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.8.0.Z.EUS:tomcat-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-1:9.0.87-1.el8_8.2.src",
"AppStream-8.8.0.Z.EUS:tomcat-admin-webapps-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-docs-webapp-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-el-3.0-api-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-lib-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-webapps-1:9.0.87-1.el8_8.2.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2024:3814"
},
{
"category": "workaround",
"details": "No mitigation is currently available for this flaw.",
"product_ids": [
"AppStream-8.8.0.Z.EUS:tomcat-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-1:9.0.87-1.el8_8.2.src",
"AppStream-8.8.0.Z.EUS:tomcat-admin-webapps-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-docs-webapp-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-el-3.0-api-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-lib-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-webapps-1:9.0.87-1.el8_8.2.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"AppStream-8.8.0.Z.EUS:tomcat-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-1:9.0.87-1.el8_8.2.src",
"AppStream-8.8.0.Z.EUS:tomcat-admin-webapps-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-docs-webapp-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-el-3.0-api-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-lib-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-webapps-1:9.0.87-1.el8_8.2.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "tomcat: improper cleaning of recycled objects could lead to information leak"
},
{
"cve": "CVE-2023-45648",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2023-10-12T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2243749"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Tomcat, where an improper input validation can occur. This flaw allows a malicious user to send a crafted request containing an invalid trailer header, which could be treated as multiple requests, potentially leading to request smuggling when behind a reverse proxy.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: incorrectly parsed http trailer headers can cause request smuggling",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The request smuggling is not guaranteed to have relevant information within every request and the scenario behind a reverse proxy which fails to handle the request too is necessary, hence the Moderate impact.\n\nThe Red Hat AMQ Broker team removed any tomcat dependencies in version 7.11.3. Please refer to https://errata.devel.redhat.com/advisory/121941.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.8.0.Z.EUS:tomcat-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-1:9.0.87-1.el8_8.2.src",
"AppStream-8.8.0.Z.EUS:tomcat-admin-webapps-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-docs-webapp-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-el-3.0-api-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-lib-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-webapps-1:9.0.87-1.el8_8.2.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2023-45648"
},
{
"category": "external",
"summary": "RHBZ#2243749",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2243749"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2023-45648",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-45648"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-45648",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-45648"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2023/10/10/10",
"url": "http://www.openwall.com/lists/oss-security/2023/10/10/10"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/2pv8yz1pyp088tsxfb7ogltk9msk0jdp",
"url": "https://lists.apache.org/thread/2pv8yz1pyp088tsxfb7ogltk9msk0jdp"
}
],
"release_date": "2023-10-10T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2024-06-11T17:34:47+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.8.0.Z.EUS:tomcat-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-1:9.0.87-1.el8_8.2.src",
"AppStream-8.8.0.Z.EUS:tomcat-admin-webapps-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-docs-webapp-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-el-3.0-api-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-lib-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-webapps-1:9.0.87-1.el8_8.2.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2024:3814"
},
{
"category": "workaround",
"details": "No mitigation is currently available for this flaw.",
"product_ids": [
"AppStream-8.8.0.Z.EUS:tomcat-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-1:9.0.87-1.el8_8.2.src",
"AppStream-8.8.0.Z.EUS:tomcat-admin-webapps-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-docs-webapp-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-el-3.0-api-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-lib-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-webapps-1:9.0.87-1.el8_8.2.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"AppStream-8.8.0.Z.EUS:tomcat-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-1:9.0.87-1.el8_8.2.src",
"AppStream-8.8.0.Z.EUS:tomcat-admin-webapps-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-docs-webapp-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-el-3.0-api-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-lib-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-webapps-1:9.0.87-1.el8_8.2.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "tomcat: incorrectly parsed http trailer headers can cause request smuggling"
},
{
"cve": "CVE-2024-23672",
"cwe": {
"id": "CWE-459",
"name": "Incomplete Cleanup"
},
"discovery_date": "2024-03-14T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2269608"
}
],
"notes": [
{
"category": "description",
"text": "A denial of service (DoS) vulnerability present in the Apache Tomcat package arises from an incomplete cleanup process. Specifically, WebSocket clients can perpetuate WebSocket connections without proper termination, thereby causing a sustained drain on system resources. This vulnerability facilitates the exploitation of Apache Tomcat servers, leading to a scenario where excessive resource consumption occurs due to the prolonged existence of these open WebSocket connections. As a consequence, the server\u0027s performance may degrade significantly, resulting in potential service disruption or unresponsiveness.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Tomcat: WebSocket DoS with incomplete closing handshake",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Denial of Service (DoS) vulnerability within the Apache Tomcat package represents an Important severity issue due to its potential to significantly impact system availability and performance. By allowing WebSocket clients to maintain open connections without proper cleanup, the vulnerability facilitates the sustained consumption of server resources. This exploitation results in increased CPU, memory, and network utilization, ultimately leading to server degradation or unresponsiveness. The inability to terminate these lingering connections efficiently exacerbates the severity of the issue, as it enables attackers to exploit limited resources over an extended period, amplifying the impact of the attack.\n\nRed Hat Certificate System 10.0 as well as Red Hat Enterprise Linux 8\u0027s Identity Management, are using a vulnerable version of Tomcat, bundled into the pki-servlet-engine component. However, there are no entry point for WebSockets, and thus it is not possible to trigger the flaw in a supported setup.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.8.0.Z.EUS:tomcat-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-1:9.0.87-1.el8_8.2.src",
"AppStream-8.8.0.Z.EUS:tomcat-admin-webapps-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-docs-webapp-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-el-3.0-api-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-lib-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-webapps-1:9.0.87-1.el8_8.2.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-23672"
},
{
"category": "external",
"summary": "RHBZ#2269608",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2269608"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-23672",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-23672"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-23672",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23672"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/cmpswfx6tj4s7x0nxxosvfqs11lvdx2f",
"url": "https://lists.apache.org/thread/cmpswfx6tj4s7x0nxxosvfqs11lvdx2f"
}
],
"release_date": "2024-03-13T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2024-06-11T17:34:47+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.8.0.Z.EUS:tomcat-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-1:9.0.87-1.el8_8.2.src",
"AppStream-8.8.0.Z.EUS:tomcat-admin-webapps-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-docs-webapp-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-el-3.0-api-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-lib-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-webapps-1:9.0.87-1.el8_8.2.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2024:3814"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"AppStream-8.8.0.Z.EUS:tomcat-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-1:9.0.87-1.el8_8.2.src",
"AppStream-8.8.0.Z.EUS:tomcat-admin-webapps-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-docs-webapp-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-el-3.0-api-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-lib-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-webapps-1:9.0.87-1.el8_8.2.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.8.0.Z.EUS:tomcat-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-1:9.0.87-1.el8_8.2.src",
"AppStream-8.8.0.Z.EUS:tomcat-admin-webapps-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-docs-webapp-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-el-3.0-api-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-lib-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-webapps-1:9.0.87-1.el8_8.2.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Tomcat: WebSocket DoS with incomplete closing handshake"
},
{
"cve": "CVE-2024-24549",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2024-03-14T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2269607"
}
],
"notes": [
{
"category": "description",
"text": "A vulnerability was found in the Tomcat package due to its handling of HTTP/2 requests. Specifically, when an HTTP/2 request surpasses the predetermined limits for headers configured within the server, the associated HTTP/2 stream isn\u0027t reset immediately. Instead, the reset action occurs only after all the headers within the request have been processed. This lapse in resetting the stream exposes the system to potential risks, as it allows malicious actors to exploit the delay in stream reset to carry out various attacks, such as header manipulation or resource exhaustion.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Tomcat: HTTP/2 header handling DoS",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability presents an Important severity issue due to its potential to facilitate various forms of attack, particularly in the context of HTTP/2 protocol. By delaying the reset of HTTP/2 streams until after processing all headers, malicious actors can exploit this window to execute header manipulation attacks, leading to potential data exfiltration, injection of malicious content, or server resource exhaustion. Furthermore, the delayed reset prolongs the exposure time of vulnerable systems, increasing the likelihood of successful exploitation.\n\nIn addition, Red Hat Certificate System 10.0 and Red Hat Enterprise Linux 8\u0027s Identity Management, are using a vulnerable version of Tomcat that is bundled into the pki-servlet-engine component. However, HTTP/2 is not enabled in such a configuration, and it is not possible to trigger the flaw in a supported setup. See https://access.redhat.com/security/cve/CVE-2020-13934 for context.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.8.0.Z.EUS:tomcat-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-1:9.0.87-1.el8_8.2.src",
"AppStream-8.8.0.Z.EUS:tomcat-admin-webapps-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-docs-webapp-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-el-3.0-api-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-lib-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-webapps-1:9.0.87-1.el8_8.2.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-24549"
},
{
"category": "external",
"summary": "RHBZ#2269607",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2269607"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-24549",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-24549"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-24549",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-24549"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/4c50rmomhbbsdgfjsgwlb51xdwfjdcvg",
"url": "https://lists.apache.org/thread/4c50rmomhbbsdgfjsgwlb51xdwfjdcvg"
}
],
"release_date": "2024-03-13T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2024-06-11T17:34:47+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.8.0.Z.EUS:tomcat-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-1:9.0.87-1.el8_8.2.src",
"AppStream-8.8.0.Z.EUS:tomcat-admin-webapps-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-docs-webapp-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-el-3.0-api-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-lib-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-webapps-1:9.0.87-1.el8_8.2.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2024:3814"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"AppStream-8.8.0.Z.EUS:tomcat-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-1:9.0.87-1.el8_8.2.src",
"AppStream-8.8.0.Z.EUS:tomcat-admin-webapps-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-docs-webapp-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-el-3.0-api-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-lib-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-webapps-1:9.0.87-1.el8_8.2.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.8.0.Z.EUS:tomcat-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-1:9.0.87-1.el8_8.2.src",
"AppStream-8.8.0.Z.EUS:tomcat-admin-webapps-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-docs-webapp-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-el-3.0-api-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-jsp-2.3-api-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-lib-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-servlet-4.0-api-1:9.0.87-1.el8_8.2.noarch",
"AppStream-8.8.0.Z.EUS:tomcat-webapps-1:9.0.87-1.el8_8.2.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Tomcat: HTTP/2 header handling DoS"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…