Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-28709: The fix for CVE-2023-24998 was incomplete for Apache Tomcat 11.0.0-M2 to 11.0.0-M4, 10.1.5 to 10.1.7, 9.0.71 to 9.0.73 and 8.5.85 to 8.5.87. If non-default HTTP connector settings were used such that the maxParameterCount could be reached using query string parameters and a request was submitted that supplied exactly maxParameterCount parameters in the query string, the limit for uploaded request parts could be bypassed with the potential for a denial of service to occur.
Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | tomcat9 | 1:9.0.71-1.amzn2023.0.3 |
| Amazon Linux · 2023 | tomcat9-admin-webapps | 1:9.0.71-1.amzn2023.0.3 |
| Amazon Linux · 2023 | tomcat9-docs-webapp | 1:9.0.71-1.amzn2023.0.3 |
| Amazon Linux · 2023 | tomcat9-el-3.0-api | 1:9.0.71-1.amzn2023.0.3 |
| Amazon Linux · 2023 | tomcat9-jsp-2.3-api | 1:9.0.71-1.amzn2023.0.3 |
| Amazon Linux · 2023 | tomcat9-lib | 1:9.0.71-1.amzn2023.0.3 |
| Amazon Linux · 2023 | tomcat9-servlet-4.0-api | 1:9.0.71-1.amzn2023.0.3 |
| Amazon Linux · 2023 | tomcat9-webapps | 1:9.0.71-1.amzn2023.0.3 |
Vulnerabilities 1
-
High 7.5CVE-2023-28709 EPSS 48%
Apache Tomcat: Fix for CVE-2023-24998 is incomplete
The fix for CVE-2023-24998 was incomplete for Apache Tomcat 11.0.0-M2 to 11.0.0-M4, 10.1.5 to 10.1.7, 9.0.71 to 9.0.73 and 8.5.85 to 8.5.87. If non-default HTTP connector settings were used such that the maxParameterCount could be reached using query string p…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-28709.html