Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| Red Hat · RHEL 8 enterprise_linux:8::appstream | tomcat | 1:9.0.62-27.el8_9 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | tomcat-admin-webapps | 1:9.0.62-27.el8_9 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | tomcat-docs-webapp | 1:9.0.62-27.el8_9 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | tomcat-el-3.0-api | 1:9.0.62-27.el8_9 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | tomcat-jsp-2.3-api | 1:9.0.62-27.el8_9 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | tomcat-lib | 1:9.0.62-27.el8_9 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | tomcat-servlet-4.0-api | 1:9.0.62-27.el8_9 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | tomcat-webapps | 1:9.0.62-27.el8_9 |
Vulnerabilities 3
-
High 7.5
Apache Commons FileUpload, Apache Tomcat: FileUpload DoS with excessive parts
Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads. Note that, like all of the file upload limits, the new c…
-
High 7.5CVE-2023-28709 EPSS 48%
Apache Tomcat: Fix for CVE-2023-24998 is incomplete
The fix for CVE-2023-24998 was incomplete for Apache Tomcat 11.0.0-M2 to 11.0.0-M4, 10.1.5 to 10.1.7, 9.0.71 to 9.0.73 and 8.5.85 to 8.5.87. If non-default HTTP connector settings were used such that the maxParameterCount could be reached using query string p…
-
Medium 4.3
Apache Tomcat: JSESSIONID Cookie missing secure attribute in some configurations
When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat 11.0.0-M1 to 11.0.0.-M2, 10.1.0-M1 to 10.1.5, 9.0.0-M1 to 9.0.71 and 8.5.0 to 8…
References
-
article
https://access.redhat.com/security/updates/classification/#moderate
-
article
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.9_release_notes/index
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2172298
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2173874
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2180856
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2189676
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2210321
-
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_7065.json
-
report
https://access.redhat.com/security/cve/CVE-2023-24998
-
advisory
https://www.cve.org/CVERecord?id=CVE-2023-24998
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-24998
-
article
https://commons.apache.org/proper/commons-fileupload/security-reports.html#Fixed_in_Apache_Commons_FileUpload_1.5
-
report
https://access.redhat.com/security/cve/CVE-2023-28708
-
advisory
https://www.cve.org/CVERecord?id=CVE-2023-28708
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-28708
-
article
https://bz.apache.org/bugzilla/show_bug.cgi?id=66471
-
article
https://lists.apache.org/thread/hdksc59z3s7tm39x0pp33mtwdrt8qr67
-
report
https://access.redhat.com/security/cve/CVE-2023-28709
-
advisory
https://www.cve.org/CVERecord?id=CVE-2023-28709
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-28709
-
article
https://lists.apache.org/thread/7wvxonzwb7k9hx9jt3q33cmy7j97jo3j