Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| Red Hat · RHEL 9 enterprise_linux:9::appstream | tomcat | 1:9.0.62-37.el9_3.1 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | tomcat-admin-webapps | 1:9.0.62-37.el9_3.1 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | tomcat-docs-webapp | 1:9.0.62-37.el9_3.1 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | tomcat-el-3.0-api | 1:9.0.62-37.el9_3.1 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | tomcat-jsp-2.3-api | 1:9.0.62-37.el9_3.1 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | tomcat-lib | 1:9.0.62-37.el9_3.1 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | tomcat-servlet-4.0-api | 1:9.0.62-37.el9_3.1 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | tomcat-webapps | 1:9.0.62-37.el9_3.1 |
Vulnerabilities 4
-
Medium 6.1CVE-2023-41080 Public exploit
Apache Tomcat: Open redirect with FORM authentication
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Tomcat.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.0.12, from 9.0.0-M1 through 9.0.79 and from 8.5.0 thr…
-
Medium 5.9
Apache Tomcat: FileUpload: DoS due to accumulation of temporary files on Windows
Incomplete Cleanup vulnerability in Apache Tomcat. The internal fork of Commons FileUpload packaged with Apache Tomcat 9.0.70 through 9.0.80 and 8.5.85 through 8.5.93 included an unreleased, in progress refactoring that exposed a potential denial of service o…
-
Medium 5.3
Apache Tomcat: Failure during request clean-up leads to sensitive data leaking to subsequent requests
Incomplete Cleanup vulnerability in Apache Tomcat.When recycling various internal objects in Apache Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.80 and from 8.5.0 through 8.5.93, an error could cause Tomc…
-
Medium 5.3CVE-2023-45648 Scanner template
Apache Tomcat: Trailer header parsing too lenient
Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.81 and from 8.5.0 through 8.5.93 did not correctly parse HTTP trailer headers. A specially crafted, in…
References
-
article
https://access.redhat.com/security/updates/classification/#moderate
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2235370
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2243749
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2243751
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2243752
-
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_0474.json
-
report
https://access.redhat.com/security/cve/CVE-2023-41080
-
advisory
https://www.cve.org/CVERecord?id=CVE-2023-41080
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-41080
-
article
https://lists.apache.org/thread/71wvwprtx2j2m54fovq9zr7gbm2wow2f
-
report
https://access.redhat.com/security/cve/CVE-2023-42794
-
advisory
https://www.cve.org/CVERecord?id=CVE-2023-42794
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-42794
-
article
http://www.openwall.com/lists/oss-security/2023/10/10/8
-
article
https://lists.apache.org/thread/vvbr2ms7lockj1hlhz5q3wmxb2mwcw82
-
report
https://access.redhat.com/security/cve/CVE-2023-42795
-
advisory
https://www.cve.org/CVERecord?id=CVE-2023-42795
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-42795
-
article
http://www.openwall.com/lists/oss-security/2023/10/10/9
-
article
https://lists.apache.org/thread/065jfyo583490r9j2v73nhpyxdob56lw
-
report
https://access.redhat.com/security/cve/CVE-2023-45648
-
advisory
https://www.cve.org/CVERecord?id=CVE-2023-45648
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-45648
-
article
http://www.openwall.com/lists/oss-security/2023/10/10/10
-
article
https://lists.apache.org/thread/2pv8yz1pyp088tsxfb7ogltk9msk0jdp