Summary
[1:9.0.62-37]
- Resolves: RHEL-12551
- Remove JDK subpackges which are unused
[1:9.0.62-16]
- Related: #2184133 Declare file conflicts
[1:9.0.62-15]
- Resolves: #2184133 Fix bug in Obsoletes
[1:9.0.62-14]
- Resolves: #2210632 CVE-2023-28709 tomcat
[1:9.0.62-13]
- Resolves: #2189675 Missing Tomcat POM files in RHEL 9.3
[1:9.0.62-12]
- Resolves: #2189675 Missing Tomcat POM files in RHEL 9.3
- Resolves: #2173872 Remove java-11-openjdk-headles as a tomcat dependency
- Resolves: #2181461 CVE-2023-28708 tomcat: not including the secure attribute causes information
- Resolves: #2210632 CVE-2023-28709
- Resolves: #2184133 Add Obsoletes to tomcat package
- Update patch command
- Update source to include the CVE fixes
Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | tomcat | 1:9.0.62-37.el9_3 |
| Oracle Linux · 9 | tomcat-admin-webapps | 1:9.0.62-37.el9_3 |
| Oracle Linux · 9 | tomcat-docs-webapp | 1:9.0.62-37.el9_3 |
| Oracle Linux · 9 | tomcat-el-3.0-api | 1:9.0.62-37.el9_3 |
| Oracle Linux · 9 | tomcat-jsp-2.3-api | 1:9.0.62-37.el9_3 |
| Oracle Linux · 9 | tomcat-lib | 1:9.0.62-37.el9_3 |
| Oracle Linux · 9 | tomcat-servlet-4.0-api | 1:9.0.62-37.el9_3 |
| Oracle Linux · 9 | tomcat-webapps | 1:9.0.62-37.el9_3 |
Vulnerabilities 3
-
High 7.5
Apache Commons FileUpload, Apache Tomcat: FileUpload DoS with excessive parts
Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads. Note that, like all of the file upload limits, the new c…
-
High 7.5CVE-2023-28709 EPSS 48%
Apache Tomcat: Fix for CVE-2023-24998 is incomplete
The fix for CVE-2023-24998 was incomplete for Apache Tomcat 11.0.0-M2 to 11.0.0-M4, 10.1.5 to 10.1.7, 9.0.71 to 9.0.73 and 8.5.85 to 8.5.87. If non-default HTTP connector settings were used such that the maxParameterCount could be reached using query string p…
-
Medium 4.3
Apache Tomcat: JSESSIONID Cookie missing secure attribute in some configurations
When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat 11.0.0-M1 to 11.0.0.-M2, 10.1.0-M1 to 10.1.5, 9.0.0-M1 to 9.0.71 and 8.5.0 to 8…