Summary
[1:9.0.62-27]
- Related: RHEL-12543
- Bump release number
[1:9.0.62-16]
- Resolves: RHEL-12543 HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)
- Remove JDK subpackges which are unused
[1:9.0.62-14]
- Related: RHEL-2330 Bump release number
[1:9.0.62-13]
- Resolves: RHEL-2330 Revert the fix for pki-servlet-engine
[1:9.0.62-12]
- Related: #2184135 Declare file conflicts
[1:9.0.62-11]
- Resolves: #2184135 Fix bug introduced in initial commit
[1:9.0.62-10]
- Resolves: #2210630 CVE-2023-28709 tomcat
- Resolves: #2181448 CVE-2023-28708 tomcat: not including the secure attribute causes information disclosure
[1:9.0.62-9]
- Resolves: #2184135 Add Obsoletes to tomcat package
[1:9.0.62-8]
- Resolves: #2189676 Missing Tomcat POM files in RHEL 8.9
[1:9.0.62-7]
- Related: #2173874 Tomcat installs older java even though newer java is installed
- Bump release number
[1:9.0.62-6]
- Resolves: #2173874 Tomcat installs older java even though newer java is installed
- Sync with rhel-8.8.0 branch
Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 8 | tomcat | 1:9.0.62-27.el8_9 |
| Oracle Linux · 8 | tomcat-admin-webapps | 1:9.0.62-27.el8_9 |
| Oracle Linux · 8 | tomcat-docs-webapp | 1:9.0.62-27.el8_9 |
| Oracle Linux · 8 | tomcat-el-3.0-api | 1:9.0.62-27.el8_9 |
| Oracle Linux · 8 | tomcat-jsp-2.3-api | 1:9.0.62-27.el8_9 |
| Oracle Linux · 8 | tomcat-lib | 1:9.0.62-27.el8_9 |
| Oracle Linux · 8 | tomcat-servlet-4.0-api | 1:9.0.62-27.el8_9 |
| Oracle Linux · 8 | tomcat-webapps | 1:9.0.62-27.el8_9 |
Vulnerabilities 3
-
High 7.5
Apache Commons FileUpload, Apache Tomcat: FileUpload DoS with excessive parts
Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads. Note that, like all of the file upload limits, the new c…
-
High 7.5CVE-2023-28709 EPSS 48%
Apache Tomcat: Fix for CVE-2023-24998 is incomplete
The fix for CVE-2023-24998 was incomplete for Apache Tomcat 11.0.0-M2 to 11.0.0-M4, 10.1.5 to 10.1.7, 9.0.71 to 9.0.73 and 8.5.85 to 8.5.87. If non-default HTTP connector settings were used such that the maxParameterCount could be reached using query string p…
-
Medium 4.3
Apache Tomcat: JSESSIONID Cookie missing secure attribute in some configurations
When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat 11.0.0-M1 to 11.0.0.-M2, 10.1.0-M1 to 10.1.5, 9.0.0-M1 to 9.0.71 and 8.5.0 to 8…