Red Hat Security AdvisoryRHSA-2023:6570
tomcat security and bug fix update
Released 2023-11-07 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream (v. 9) tomcat-1:9.0.62-37.el9_3, tomcat-admin-webapps-1:9.0.62-37.el9_3, tomcat-docs-webapp-1:9.0.62-37.el9_3 +5
Fixes 3 records
Priority HIGH 70
Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.48788 · Published 2023-02-20 · Partial fix · 1.5, 10.1.5 +3 CWE-770
Priority HIGH 69
The fix for CVE-2023-24998 was incomplete for Apache Tomcat 11.0.0-M2 to 11.0.0-M4, 10.1.5 to 10.1.7, 9.0.71 to 9.0.73 and 8.5.85 to 8.5.87.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.48031 · Published 2023-05-22 · Partial fix · 11.0.0-M5, 10.1.8 +2 CWE-193
Priority LOW 24
When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat 11.0.0-M1 to 11.0.0.-M2, 10.1.0-M1 to 10…
CVSS 3.1MEDIUM 4.3· Network · No auth · User interaction · EPSS 0.01831 · Published 2023-03-22 · Partial fix · 11.0.0-M3, 10.1.6 +2 CWE-523
