Lucene search
AlmaLinuxALSA-2023:5928HistoryOct 19, 2023 - 12:00 a.m.
Important: tomcat security update
2023-10-1900:00:00
errata.almalinux.org
28
tomcat
security update
http/2
vulnerability
ddos
rapid reset attack
cvss score
references
unix
CVSS3
7.5
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS
0.813
Percentile
98.4%
Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.
Security Fix(es):
- HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| almalinux | 8 | noarch | tomcat-docs-webapp | < 9.0.62-5.el8_8.2 | tomcat-docs-webapp-9.0.62-5.el8_8.2.noarch.rpm |
| almalinux | 8 | noarch | tomcat | < 9.0.62-5.el8_8.2 | tomcat-9.0.62-5.el8_8.2.noarch.rpm |
| almalinux | 8 | noarch | tomcat-jsp-2.3-api | < 9.0.62-5.el8_8.2 | tomcat-jsp-2.3-api-9.0.62-5.el8_8.2.noarch.rpm |
| almalinux | 8 | noarch | tomcat-admin-webapps | < 9.0.62-5.el8_8.2 | tomcat-admin-webapps-9.0.62-5.el8_8.2.noarch.rpm |
| almalinux | 8 | noarch | tomcat-webapps | < 9.0.62-5.el8_8.2 | tomcat-webapps-9.0.62-5.el8_8.2.noarch.rpm |
| almalinux | 8 | noarch | tomcat-servlet-4.0-api | < 9.0.62-5.el8_8.2 | tomcat-servlet-4.0-api-9.0.62-5.el8_8.2.noarch.rpm |
| almalinux | 8 | noarch | tomcat-el-3.0-api | < 9.0.62-5.el8_8.2 | tomcat-el-3.0-api-9.0.62-5.el8_8.2.noarch.rpm |
| almalinux | 8 | noarch | tomcat-lib | < 9.0.62-5.el8_8.2 | tomcat-lib-9.0.62-5.el8_8.2.noarch.rpm |
Related
osv
osv
CGA-rx36-6r58-w9cv
2024-06-06 12:29:26
CGA-rfpm-7c5c-2jr7
2024-06-06 12:29:18
CGA-r6pc-j2w2-hg9j
2024-06-06 12:29:16
nessus
nessus
Photon OS 4.0: Openresty PHSA-2024-4.0-0539
2024-07-24 00:00:00
Photon OS 5.0: Nginx PHSA-2023-5.0-0123
2024-07-24 00:00:00
debiancve
debiancve
CVE-2023-44487
2023-10-10 14:15:10
alpinelinux
alpinelinux
CVE-2023-44487
2023-10-10 14:15:10
redhat
redhat
(RHSA-2023:5714) Moderate: nginx security update
2023-10-16 08:07:21
(RHSA-2023:5705) Important: rh-dotnet60-dotnet security, bug fix, and enhancement update
2023-10-16 08:00:49
(RHSA-2023:5766) Important: nghttp2 security update
2023-10-17 08:49:06
hivepro
hivepro
Attacks, Vulnerabilities and Actors 9 October to 15 October 2023
2023-10-17 09:10:10
HTTP2 Zero-Day Exploited for the Most Explosive DDoS Attacks
2023-10-12 08:09:28
almalinux
almalinux
Important: dotnet7.0 security update
2023-10-16 00:00:00
Moderate: nginx:1.22 security update
2023-10-25 00:00:00
Important: nodejs security update
2023-10-17 00:00:00
rocky
rocky
.NET 7.0 security update
2023-10-24 18:36:50
nghttp2 security update
2023-11-11 23:00:24
fedora
fedora
[SECURITY] Fedora 37 Update: cachelib-17^20231016-1.fc37
2023-10-24 01:13:17
[SECURITY] Fedora 37 Update: folly-2023.10.16.00-1.fc37
2023-10-24 01:13:18
[SECURITY] Fedora 37 Update: mcrouter-0.41.0.20231016-1.fc37
2023-10-24 01:13:18
cbl_mariner
cbl_mariner
CVE-2023-44487 affecting package grpc for versions less than 1.42.0-7
2024-03-21 08:27:20
CVE-2023-44487 affecting package skopeo for versions less than 1.12.0-4
2024-02-25 03:00:06
cgr
cgr
CVE-2023-44487 vulnerabilities
2024-05-19 03:07:16
ibm
ibm
oraclelinux
oraclelinux
nghttp2 security update
2023-10-19 00:00:00
nodejs:16 security update
2023-10-20 00:00:00
nghttp2 security update
2023-11-16 00:00:00
talosblog
talosblog
impervablog
impervablog
HTTP/2 Rapid Reset Mitigation With Imperva WAF
2024-01-03 14:21:45
Protecting Against HTTP/2 Rapid Reset: CVE-2023-44487
2023-10-10 12:24:39
debian
debian
[SECURITY] [DLA 3656-1] netty security update
2023-11-19 20:45:02
openvas
openvas
Huawei EulerOS: Security Advisory for nginx (EulerOS-SA-2024-1154)
2024-02-09 00:00:00
Fedora: Security Advisory for folly (FEDORA-2023-17efd3f2cd)
2023-10-25 00:00:00
Fedora: Security Advisory for wdt (FEDORA-2023-17efd3f2cd)
2023-10-25 00:00:00
nvd
nvd
CVE-2023-44487
2023-10-10 14:15:10
cisa_kev
cisa_kev
HTTP/2 Rapid Reset Attack Vulnerability
2023-10-10 00:00:00
cnvd
cnvd
F5 BIG-IP Denial of Service Vulnerability (CNVD-2023-75597)
2023-10-11 00:00:00
redos
redos
ROS-20240503-02
2024-05-03 00:00:00
gitlab
gitlab
HTTP/2 Stream Cancellation Attack
2023-10-10 00:00:00
atlassian
atlassian
github
github
github.com/nghttp2/nghttp2 has HTTP/2 Rapid Reset
2023-10-10 18:23:21
cve
cve
CVE-2023-44487
2023-10-10 14:15:10
githubexploit
githubexploit
Exploit for Uncontrolled Resource Consumption in Ietf Http
2023-10-10 14:20:42
Exploit for Uncontrolled Resource Consumption in Ietf Http
2023-10-11 01:59:47
wolfi
wolfi
CVE-2023-44487 vulnerabilities
2024-09-12 21:14:46
cisco
cisco
HTTP/2 Rapid Reset Attack Affecting Cisco Products: October 2023
2023-10-16 16:00:00
ubuntu
ubuntu
.NET vulnerability
2023-10-10 00:00:00
amazon
amazon
Important: nginx
2023-10-16 13:45:00
CVSS3
7.5
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS
0.813
Percentile
98.4%
Related for ALSA-2023:5928