Read the docs
Red Hat Security Advisory

RHSA-2024:3814

tomcat security and bug fix update

Released 2024-06-11 · Red Hat rating Important · View on Red Hat →

Fixed in

Fixes 8 records

TI-2023-10471 CVE-2023-24998 · GHSA-hfrx-6qgj-fp6c

Apache Commons FileUpload, Apache Tomcat: FileUpload DoS with excessive parts

Priority HIGH 70

Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.48788 Published 2023-02-20 Partial fix · 1.5, 10.1.5 +3 CWE-770
TI-2024-16171 CVE-2024-24549 · GHSA-7w75-32cg-r6g2

Apache Tomcat: HTTP/2 header handling DoS

Priority MEDIUM 53

Denial of Service due to improper input validation vulnerability for HTTP/2 requests in Apache Tomcat.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.23072 Published 2024-03-13 Partial fix · 11.0.0-M17, 10.1.19 +2 CWE-20
TI-2023-24449 CVE-2023-45648 · GHSA-r6j3-px5g-cq3x

Apache Tomcat: Trailer header parsing too lenient

Priority LOW 39

Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.81 and from 8.5.0 through 8.5.93 did not correctly parse HTTP t…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.05883 Published 2023-10-10 Partial fix · 11.0.0-M12, 10.1.14 +2 CWE-20
TI-2022-22218 CVE-2022-45143 · GHSA-rq2w-37h9-vg94

Apache Tomcat: JsonErrorReportValve escaping

Priority LOW 38

The JsonErrorReportValve in Apache Tomcat 8.5.83, 9.0.40 to 9.0.68 and 10.1.0-M1 to 10.1.1 did not escape the type, message or description values.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02669 Published 2023-01-03 Partial fix · 8.5.84, 9.0.69 +1 CWE-116
TI-2023-21704 CVE-2023-41080 · GHSA-q3mw-pvr8-9ggc

Apache Tomcat: Open redirect with FORM authentication

Priority LOW 37

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Tomcat.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.0.12, from 9.0…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.06459 Published 2023-08-25 Partial fix · 11.0.0-M11, 10.1.13 +2 CWE-601
TI-2023-22886 CVE-2023-42795 · GHSA-g8pj-r55q-5c2v

Apache Tomcat: Failure during request clean-up leads to sensitive data leaking to subsequent requests

Priority LOW 35

Incomplete Cleanup vulnerability in Apache Tomcat.When recycling various internal objects in Apache Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.80 and from 8.5.0 th…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.02515 Published 2023-10-10 Partial fix · 11.0.0-M12, 10.1.14 +2 CWE-459
TI-2023-13225 CVE-2023-28708 · GHSA-2c9m-w27f-53rm

Apache Tomcat: JSESSIONID Cookie missing secure attribute in some configurations

Priority LOW 24

When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat 11.0.0-M1 to 11.0.0.-M2, 10.1.0-M1 to 10…

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.01831 Published 2023-03-22 Partial fix · 11.0.0-M3, 10.1.6 +2 CWE-523