Skip to content
OpenAdvisories
High RHSA-2024:3308 2 CVEs

Red Hat Security Advisory: tomcat security and bug fix update

Published Sep 16, 2024 · Updated Sep 28, 2026

Ecosystem: Red Hat

Fixed packages 8

ReleasePackageFixed in
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::appstream tomcat 1:9.0.87-1.el9_2.1
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::appstream tomcat-admin-webapps 1:9.0.87-1.el9_2.1
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::appstream tomcat-docs-webapp 1:9.0.87-1.el9_2.1
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::appstream tomcat-el-3.0-api 1:9.0.87-1.el9_2.1
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::appstream tomcat-jsp-2.3-api 1:9.0.87-1.el9_2.1
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::appstream tomcat-lib 1:9.0.87-1.el9_2.1
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::appstream tomcat-servlet-4.0-api 1:9.0.87-1.el9_2.1
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::appstream tomcat-webapps 1:9.0.87-1.el9_2.1

Vulnerabilities 2

  • High 7.5
    CVE-2024-24549 Public exploit EPSS 23%

    Apache Tomcat: HTTP/2 header handling DoS

    Denial of Service due to improper input validation vulnerability for HTTP/2 requests in Apache Tomcat. When processing an HTTP/2 request, if the request exceeded any of the configured limits for headers, the associated HTTP/2 stream was not reset until after …

    Apache Software Foundation Apache Tomcat tomcat8 tomcat9 Debian Ubuntu Maven
  • Medium 6.3
    CVE-2024-23672

    Apache Tomcat: WebSocket DoS with incomplete closing handshake

    Denial of Service via incomplete cleanup vulnerability in Apache Tomcat. It was possible for WebSocket clients to keep WebSocket connections open leading to increased resource consumption.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, fr…

    Apache Software Foundation Apache Tomcat tomcat8 tomcat9 Debian Ubuntu Maven

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2269607
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2269608
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_3308.json
  • report
    https://access.redhat.com/security/cve/CVE-2024-23672
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2024-23672
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2024-23672
  • article
    https://lists.apache.org/thread/cmpswfx6tj4s7x0nxxosvfqs11lvdx2f
  • report
    https://access.redhat.com/security/cve/CVE-2024-24549
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2024-24549
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2024-24549
  • article
    https://lists.apache.org/thread/4c50rmomhbbsdgfjsgwlb51xdwfjdcvg