Moderate: tomcat security update
Summary
ALSA-2024:0474: Moderate: tomcat security update. Affects tomcat versions < 1:9.0.62-37.el9_3.1. Fixed in 1:9.0.62-37.el9_3.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies. It provides a web server environment for Java-based web applications to run. Tomcat is widely used and popular in the Java community.
Vulnerability Detail
This security update addresses multiple vulnerabilities in Apache Tomcat:
-
Open Redirect vulnerability in FORM authentication (CVE-2023-41080): This vulnerability allows an attacker to redirect users to a malicious website by manipulating the authentication process.
-
DoS due to accumulation of temporary files on Windows (CVE-2023-42794): This vulnerability can be exploited to cause a denial-of-service (DoS) attack by filling up the disk space with temporary files.
-
Improper cleaning of recycled objects could lead to information leak (CVE-2023-42795): This vulnerability may result in the leakage of sensitive information due to improper handling of recycled objects.
-
Incorrectly parsed HTTP trailer headers can cause request smuggling (CVE-2023-45648): This vulnerability allows an attacker to smuggle malicious requests by manipulating the parsing of HTTP trailer headers.
How To Fix
Minimum fixed version
1:9.0.62-37.el9_3.1
This is the first release that contains the fix.
sudo dnf update tomcatTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
This security update addresses multiple vulnerabilities in Apache Tomcat. It is recommended to update to the latest version to ensure the security of your web applications. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for tomcat →
FAQ
Apache Tomcat is a popular open-source servlet container for running Java-based web applications.
The Open Redirect vulnerability allows an attacker to redirect users to a malicious website, potentially leading to phishing attacks or the theft of sensitive information.
You can use the Vulert playground (https://vulert.com/scanner) to check if your version of Apache Tomcat is affected by this vulnerability.
No specific workarounds have been mentioned for these vulnerabilities. It is recommended to update to the latest version of Apache Tomcat.
You can refer to the CVE pages listed in the References section of the vulnerability details for more information about each vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for tomcat.
