Skip to content
OpenAdvisories
High RHSA-2024:3307 3 CVEs

Red Hat Security Advisory: tomcat security and bug fix update

Published Sep 16, 2024 · Updated Oct 2, 2026

Ecosystem: Red Hat

Fixed packages 8

ReleasePackageFixed in
Red Hat · RHEL 9 enterprise_linux:9::appstream tomcat 1:9.0.87-1.el9_4.1
Red Hat · RHEL 9 enterprise_linux:9::appstream tomcat-admin-webapps 1:9.0.87-1.el9_4.1
Red Hat · RHEL 9 enterprise_linux:9::appstream tomcat-docs-webapp 1:9.0.87-1.el9_4.1
Red Hat · RHEL 9 enterprise_linux:9::appstream tomcat-el-3.0-api 1:9.0.87-1.el9_4.1
Red Hat · RHEL 9 enterprise_linux:9::appstream tomcat-jsp-2.3-api 1:9.0.87-1.el9_4.1
Red Hat · RHEL 9 enterprise_linux:9::appstream tomcat-lib 1:9.0.87-1.el9_4.1
Red Hat · RHEL 9 enterprise_linux:9::appstream tomcat-servlet-4.0-api 1:9.0.87-1.el9_4.1
Red Hat · RHEL 9 enterprise_linux:9::appstream tomcat-webapps 1:9.0.87-1.el9_4.1

Vulnerabilities 3

  • High 7.5
    CVE-2022-45143

    Apache Tomcat: JsonErrorReportValve escaping

    The JsonErrorReportValve in Apache Tomcat 8.5.83, 9.0.40 to 9.0.68 and 10.1.0-M1 to 10.1.1 did not escape the type, message or description values. In some circumstances these are constructed from user provided data and it was therefore possible for users to s…

    Apache Software Foundation Apache Tomcat tomcat9 tomcat9 Debian Ubuntu Maven
  • High 7.5
    CVE-2024-24549 Public exploit EPSS 23%

    Apache Tomcat: HTTP/2 header handling DoS

    Denial of Service due to improper input validation vulnerability for HTTP/2 requests in Apache Tomcat. When processing an HTTP/2 request, if the request exceeded any of the configured limits for headers, the associated HTTP/2 stream was not reset until after …

    Apache Software Foundation Apache Tomcat tomcat8 tomcat9 Debian Ubuntu Maven
  • Medium 6.3
    CVE-2024-23672

    Apache Tomcat: WebSocket DoS with incomplete closing handshake

    Denial of Service via incomplete cleanup vulnerability in Apache Tomcat. It was possible for WebSocket clients to keep WebSocket connections open leading to increased resource consumption.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, fr…

    Apache Software Foundation Apache Tomcat tomcat8 tomcat9 Debian Ubuntu Maven

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2269607
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2269608
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_3307.json
  • report
    https://access.redhat.com/security/cve/CVE-2022-45143
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2158695
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2022-45143
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2022-45143
  • article
    https://lists.apache.org/thread/yqkd183xrw3wqvnpcg3osbcryq85fkzj
  • report
    https://access.redhat.com/security/cve/CVE-2024-23672
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2024-23672
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2024-23672
  • article
    https://lists.apache.org/thread/cmpswfx6tj4s7x0nxxosvfqs11lvdx2f
  • report
    https://access.redhat.com/security/cve/CVE-2024-24549
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2024-24549
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2024-24549
  • article
    https://lists.apache.org/thread/4c50rmomhbbsdgfjsgwlb51xdwfjdcvg