[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

[SECURITY] [DLA 3617-1] tomcat9 security update

Debian LTS Advisory DLA-3617-1                debian-lts@lists.debian.org
https://www.debian.org/lts/security/                      Markus Koschany
October 13, 2023                              https://wiki.debian.org/LTS

Package        : tomcat9
Version        : 9.0.31-1~deb10u9
CVE ID         : CVE-2023-24998 CVE-2023-41080 CVE-2023-42795 CVE-2023-44487 

Several security vulnerabilities have been discovered in the Tomcat
servlet and JSP engine.


    Denial of service. Tomcat uses a packaged renamed copy of Apache Commons
    FileUpload to provide the file upload functionality defined in the Jakarta
    Servlet specification. Apache Tomcat was, therefore, also vulnerable to the
    Commons FileUpload vulnerability CVE-2023-24998 as there was no limit to
    the number of request parts processed. This resulted in the possibility of
    an attacker triggering a DoS with a malicious upload or series of uploads.


    Open redirect. If the ROOT (default) web application is configured to use
    FORM authentication then it is possible that a specially crafted URL could
    be used to trigger a redirect to an URL of the attackers choice.


    Information Disclosure. When recycling various internal objects, including
    the request and the response, prior to re-use by the next request/response,
    an error could cause Tomcat to skip some parts of the recycling process
    leading to information leaking from the current request/response to the


    DoS caused by HTTP/2 frame overhead (Rapid Reset Attack)


    Request smuggling. Tomcat did not correctly parse HTTP trailer headers. A
    specially crafted, invalid trailer header could cause Tomcat to treat a
    single request as multiple requests leading to the possibility of request
    smuggling when behind a reverse proxy.

For Debian 10 buster, these problems have been fixed in version

We recommend that you upgrade your tomcat9 packages.

For the detailed security status of tomcat9 please refer to
its security tracker page at:

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

Attachment: signature.asc
Description: This is a digitally signed message part

Reply to: