Summary
Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.
Security Fix(es):
* Apache Commons FileUpload: FileUpload DoS with excessive parts (CVE-2023-24998)
* tomcat: not including the secure attribute causes information disclosure (CVE-2023-28708)
* tomcat: Fix for CVE-2023-24998 was incomplete (CVE-2023-28709)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 9 | tomcat | 1:9.0.62-37.el9_3 |
| AlmaLinux · 9 | tomcat-admin-webapps | 1:9.0.62-37.el9_3 |
| AlmaLinux · 9 | tomcat-docs-webapp | 1:9.0.62-37.el9_3 |
| AlmaLinux · 9 | tomcat-el-3.0-api | 1:9.0.62-37.el9_3 |
| AlmaLinux · 9 | tomcat-jsp-2.3-api | 1:9.0.62-37.el9_3 |
| AlmaLinux · 9 | tomcat-lib | 1:9.0.62-37.el9_3 |
| AlmaLinux · 9 | tomcat-servlet-4.0-api | 1:9.0.62-37.el9_3 |
| AlmaLinux · 9 | tomcat-webapps | 1:9.0.62-37.el9_3 |
Vulnerabilities 3
-
High 7.5
Apache Commons FileUpload, Apache Tomcat: FileUpload DoS with excessive parts
Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads. Note that, like all of the file upload limits, the new c…
-
High 7.5CVE-2023-28709 EPSS 48%
Apache Tomcat: Fix for CVE-2023-24998 is incomplete
The fix for CVE-2023-24998 was incomplete for Apache Tomcat 11.0.0-M2 to 11.0.0-M4, 10.1.5 to 10.1.7, 9.0.71 to 9.0.73 and 8.5.85 to 8.5.87. If non-default HTTP connector settings were used such that the maxParameterCount could be reached using query string p…
-
Medium 4.3
Apache Tomcat: JSESSIONID Cookie missing secure attribute in some configurations
When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat 11.0.0-M1 to 11.0.0.-M2, 10.1.0-M1 to 10.1.5, 9.0.0-M1 to 9.0.71 and 8.5.0 to 8…
References
-
report
https://access.redhat.com/security/cve/CVE-2023-24998
-
report
https://access.redhat.com/security/cve/CVE-2023-28708
-
report
https://access.redhat.com/security/cve/CVE-2023-28709
-
report
https://bugzilla.redhat.com/2172298
-
report
https://bugzilla.redhat.com/2180856
-
report
https://bugzilla.redhat.com/2210321
-
advisory
https://errata.almalinux.org/9/ALSA-2023-6570.html