GHSA-v682-8vv8-vpwr
Denial of Service via incomplete cleanup vulnerability in Apache Tomcat
At a glance
- Published
- Updated
- CVE
- CVE-2024-23672
- Aliases
- BIT-tomcat-2024-23672
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Description
Denial of Service via incomplete cleanup vulnerability in Apache Tomcat. It was possible for WebSocket clients to keep WebSocket connections open leading to increased resource consumption.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, from 10.1.0-M1 through 10.1.18, from 9.0.0-M1 through 9.0.85, from 8.5.0 through 8.5.98. Older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.0-M17, 10.1.19, 9.0.86 or 8.5.99 which fix the issue.
Affected packages
| Package | Versions |
|---|---|
| Maven · org.apache.tomcat:tomcat-websocket | introduced 11.0.0-M1, fixed 11.0.0-M17 |
| Maven · org.apache.tomcat:tomcat-websocket | introduced 10.1.0-M1, fixed 10.1.19 |
| Maven · org.apache.tomcat:tomcat-websocket | introduced 9.0.0-M1, fixed 9.0.86 |
| Maven · org.apache.tomcat:tomcat-websocket | introduced 8.5.0, fixed 8.5.99 |
| Maven · org.apache.tomcat.embed:tomcat-embed-websocket | introduced 11.0.0-M1, fixed 11.0.0-M17 |
| Maven · org.apache.tomcat.embed:tomcat-embed-websocket | introduced 10.1.0-M1, fixed 10.1.19 |
| Maven · org.apache.tomcat.embed:tomcat-embed-websocket | introduced 9.0.0-M1, fixed 9.0.86 |
| Maven · org.apache.tomcat.embed:tomcat-embed-websocket | introduced 8.5.0, fixed 8.5.99 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2024-23672 ADVISORY
- https://github.com/apache/tomcat/commit/0052b374684b613b0c849899b325ebe334ac6501 WEB
- https://github.com/apache/tomcat/commit/3631adb1342d8bbd8598802a12b63ad02c37d591 WEB
- https://github.com/apache/tomcat/commit/52d6650e062d880704898d7d8c1b2b7a3efe8068 WEB
- https://github.com/apache/tomcat/commit/b0e3b1bd78de270d53e319d7cb79eb282aa53cb9 WEB
- https://github.com/apache/tomcat PACKAGE
- https://lists.apache.org/thread/cmpswfx6tj4s7x0nxxosvfqs11lvdx2f WEB
- https://lists.debian.org/debian-lts-announce/2024/04/msg00001.html WEB
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3UWIS5MMGYDZBLJYT674ZI5AWFHDZ46B WEB
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/736G4GPZWS2DSQO5WKXO3G6OMZKFEK55 WEB
- https://security.netapp.com/advisory/ntap-20240402-0002 WEB
- http://www.openwall.com/lists/oss-security/2024/03/13/4 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |