Summary
[1:9.0.87-1.el9_4.1]
- Resolves: RHEL-34815 - Rebase tomcat to version 9.0.87
- Resolves: RHEL-31048
tomcat: Apache Tomcat: WebSocket DoS with incomplete closing handshake (CVE-2024-23672)
- Resolves: RHEL-31032
tomcat: : Apache Tomcat: HTTP/2 header handling DoS (CVE-2024-24549)
- Resolves: RHEL-35328 - Amend tomcat's changelog
(CVE-2023-46589, CVE-2023-45648, CVE-2023-42795, CVE-2023-42794, CVE-2023-44487, CVE-2023-41080)
Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | tomcat | 1:9.0.87-1.el9_4.1 |
| Oracle Linux · 9 | tomcat-admin-webapps | 1:9.0.87-1.el9_4.1 |
| Oracle Linux · 9 | tomcat-docs-webapp | 1:9.0.87-1.el9_4.1 |
| Oracle Linux · 9 | tomcat-el-3.0-api | 1:9.0.87-1.el9_4.1 |
| Oracle Linux · 9 | tomcat-jsp-2.3-api | 1:9.0.87-1.el9_4.1 |
| Oracle Linux · 9 | tomcat-lib | 1:9.0.87-1.el9_4.1 |
| Oracle Linux · 9 | tomcat-servlet-4.0-api | 1:9.0.87-1.el9_4.1 |
| Oracle Linux · 9 | tomcat-webapps | 1:9.0.87-1.el9_4.1 |
Vulnerabilities 2
-
High 7.5
Apache Tomcat: HTTP/2 header handling DoS
Denial of Service due to improper input validation vulnerability for HTTP/2 requests in Apache Tomcat. When processing an HTTP/2 request, if the request exceeded any of the configured limits for headers, the associated HTTP/2 stream was not reset until after …
-
Medium 6.3
Apache Tomcat: WebSocket DoS with incomplete closing handshake
Denial of Service via incomplete cleanup vulnerability in Apache Tomcat. It was possible for WebSocket clients to keep WebSocket connections open leading to increased resource consumption.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, fr…