Skip to content
OpenAdvisories
High ALAS2-2024-2514 1 CVE

Important: tomcat security update (Amazon Linux 2)

Published Apr 11, 2024 · Updated Apr 15, 2024

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-23672: Denial of Service via incomplete cleanup vulnerability in Apache Tomcat. It was possible for WebSocket clients to keep WebSocket connections open leading to increased resource consumption.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, from 10.1.0-M1 through 10.1.18, from 9.0.0-M1 through 9.0.85, from 8.5.0 through 8.5.98. Users are recommended to upgrade to version 11.0.0-M17, 10.1.19, 9.0.86 or 8.5.99 which fix the issue.

Fixed packages 10

ReleasePackageFixed in
Amazon Linux · 2 tomcat 0:7.0.76-10.amzn2.0.8
Amazon Linux · 2 tomcat-admin-webapps 0:7.0.76-10.amzn2.0.8
Amazon Linux · 2 tomcat-docs-webapp 0:7.0.76-10.amzn2.0.8
Amazon Linux · 2 tomcat-el-2.2-api 0:7.0.76-10.amzn2.0.8
Amazon Linux · 2 tomcat-javadoc 0:7.0.76-10.amzn2.0.8
Amazon Linux · 2 tomcat-jsp-2.2-api 0:7.0.76-10.amzn2.0.8
Amazon Linux · 2 tomcat-jsvc 0:7.0.76-10.amzn2.0.8
Amazon Linux · 2 tomcat-lib 0:7.0.76-10.amzn2.0.8
Amazon Linux · 2 tomcat-servlet-3.0-api 0:7.0.76-10.amzn2.0.8
Amazon Linux · 2 tomcat-webapps 0:7.0.76-10.amzn2.0.8

Vulnerabilities 1

  • Medium 6.3
    CVE-2024-23672

    Apache Tomcat: WebSocket DoS with incomplete closing handshake

    Denial of Service via incomplete cleanup vulnerability in Apache Tomcat. It was possible for WebSocket clients to keep WebSocket connections open leading to increased resource consumption.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, fr…

    Apache Software Foundation Apache Tomcat tomcat8 tomcat9 Debian Ubuntu Maven

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-23672.html