Skip to content
OpenAdvisories
High ALSA-2024:3666 3 CVEs

Important: tomcat security and bug fix update

Published Jun 6, 2024 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

Security Fix(es):

* Apache Tomcat: HTTP/2 header handling DoS (CVE-2024-24549)
* Apache Tomcat: WebSocket DoS with incomplete closing handshake (CVE-2024-23672)

Bug Fix(es):

* Rebase tomcat to version 9.0.87 (JIRA:AlmaLinux-35813)
* Amend tomcat package's changelog so that fixed CVEs are mentioned explicitly (JIRA:AlmaLinux-38548)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 8

ReleasePackageFixed in
AlmaLinux · 8 tomcat 1:9.0.87-1.el8_10.1.alma.1
AlmaLinux · 8 tomcat-admin-webapps 1:9.0.87-1.el8_10.1.alma.1
AlmaLinux · 8 tomcat-docs-webapp 1:9.0.87-1.el8_10.1.alma.1
AlmaLinux · 8 tomcat-el-3.0-api 1:9.0.87-1.el8_10.1.alma.1
AlmaLinux · 8 tomcat-jsp-2.3-api 1:9.0.87-1.el8_10.1.alma.1
AlmaLinux · 8 tomcat-lib 1:9.0.87-1.el8_10.1.alma.1
AlmaLinux · 8 tomcat-servlet-4.0-api 1:9.0.87-1.el8_10.1.alma.1
AlmaLinux · 8 tomcat-webapps 1:9.0.87-1.el8_10.1.alma.1

Vulnerabilities 3

  • High 7.5
    CVE-2022-45143

    Apache Tomcat: JsonErrorReportValve escaping

    The JsonErrorReportValve in Apache Tomcat 8.5.83, 9.0.40 to 9.0.68 and 10.1.0-M1 to 10.1.1 did not escape the type, message or description values. In some circumstances these are constructed from user provided data and it was therefore possible for users to s…

    Apache Software Foundation Apache Tomcat tomcat9 tomcat9 Debian Ubuntu Maven
  • High 7.5
    CVE-2024-24549 Public exploit EPSS 23%

    Apache Tomcat: HTTP/2 header handling DoS

    Denial of Service due to improper input validation vulnerability for HTTP/2 requests in Apache Tomcat. When processing an HTTP/2 request, if the request exceeded any of the configured limits for headers, the associated HTTP/2 stream was not reset until after …

    Apache Software Foundation Apache Tomcat tomcat8 tomcat9 Debian Ubuntu Maven
  • Medium 6.3
    CVE-2024-23672

    Apache Tomcat: WebSocket DoS with incomplete closing handshake

    Denial of Service via incomplete cleanup vulnerability in Apache Tomcat. It was possible for WebSocket clients to keep WebSocket connections open leading to increased resource consumption.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, fr…

    Apache Software Foundation Apache Tomcat tomcat8 tomcat9 Debian Ubuntu Maven

References

  • report
    https://access.redhat.com/security/cve/CVE-2024-23672
  • report
    https://access.redhat.com/security/cve/CVE-2024-24549
  • report
    https://bugzilla.redhat.com/2269607
  • report
    https://bugzilla.redhat.com/2269608
  • advisory
    https://errata.almalinux.org/8/ALSA-2024-3666.html
  • report
    https://www.redhat.com/security/data/cve/CVE-2022-45143.html