tomcat10 - security update

Fixed packages 1

Vulnerabilities 6

• Critical 9.8
  CVE-2024-50379 Public exploit EPSS 32%

  Apache Tomcat: RCE due to TOCTOU issue in JSP compilation

  Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP compilation in Apache Tomcat permits an RCE on case insensitive file systems when the default servlet is enabled for write (non-default configuration). This issue affects Apache Tomcat…

  Apache Software Foundation Apache Tomcat thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  Dec 17, 2024
• Critical 9.8
  CVE-2024-52316 Public exploit

  Apache Tomcat: Authentication bypass when using Jakarta Authentication API

  Unchecked Error Condition vulnerability in Apache Tomcat. If Tomcat is configured to use a custom Jakarta Authentication (formerly JASPIC) ServerAuthContext component which may throw an exception during the authentication process without explicitly setting an…

  Apache Software Foundation Apache Tomcat tomcat8 tomcat9 Debian Ubuntu Maven
  Nov 18, 2024
• Critical 9.8
  CVE-2024-56337

  Apache Tomcat: RCE due to TOCTOU issue in JSP compilation - CVE-2024-50379 mitigation was incomplete

  Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97. The following versions were EOL at the time the CV…

  Apache Software Foundation Apache Tomcat thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  Dec 20, 2024
• High 8.6
  CVE-2024-38286

  Apache Tomcat: Denial of Service

  Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from 9.0.13 through 9.0.89. The following versions were EOL at the time t…

  Apache Software Foundation Apache Tomcat tomcat9 tomcat8 Debian Ubuntu Maven
  Nov 7, 2024
• High 7.5
  CVE-2024-34750

  Apache Tomcat: HTTP/2 excess header handling DoS

  Improper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache Tomcat. When processing an HTTP/2 stream, Tomcat did not handle some cases of excessive HTTP headers correctly. This led to a miscounting of active HTTP/2 s…

  Apache Software Foundation Apache Tomcat thingsboard-tb-mqtt-transport tomcat9 Debian Ubuntu Wolfi Maven
  Jul 3, 2024
• Medium 5.3
  CVE-2024-54677

  Apache Tomcat: DoS in examples web application

  Uncontrolled Resource Consumption vulnerability in the examples web application provided with Apache Tomcat leads to denial of service. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.9.…

  Apache Software Foundation Apache Tomcat org.apache.tomcat:tomcat tomcat9 Debian Ubuntu Maven
  Dec 17, 2024