CVE-2023-42794

2023-10-1018:15:18

Debian Security Bug Tracker

security-tracker.debian.org

apache tomcat

incomplete cleanup

vulnerability

windows

denial of service

upgrade

disk full

6.3 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

14.6%

JSON

Incomplete Cleanup vulnerability in Apache Tomcat. The internal fork of Commons FileUpload packaged with Apache Tomcat 9.0.70 through 9.0.80 and 8.5.85 through 8.5.93 included an unreleased, in progress refactoring that exposed a potential denial of service on Windows if a web application opened a stream for an uploaded file but failed to close the stream. The file would never be deleted from disk creating the possibility of an eventual denial of service due to the disk being full. Users are recommended to upgrade to version 9.0.81 onwards or 8.5.94 onwards, which fixes the issue.

OSVersionArchitecturePackageVersionFilename
Debian12alltomcat10< 10.1.6-1+deb12u1tomcat10_10.1.6-1+deb12u1_all.deb
Debian999alltomcat10< 10.1.23-1tomcat10_10.1.23-1_all.deb
Debian13alltomcat10< 10.1.23-1tomcat10_10.1.23-1_all.deb
Debian12alltomcat9< 9.0.70-2tomcat9_9.0.70-2_all.deb
Debian11alltomcat9< 9.0.43-2~deb11u9tomcat9_9.0.43-2~deb11u9_all.deb
Debian10alltomcat9< 9.0.31-1~deb10u6tomcat9_9.0.31-1~deb10u6_all.deb
Debian999alltomcat9< 9.0.70-2tomcat9_9.0.70-2_all.deb
Debian13alltomcat9< 9.0.70-2tomcat9_9.0.70-2_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	tomcat10	< 10.1.6-1+deb12u1	tomcat10_10.1.6-1+deb12u1_all.deb
Debian	999	all	tomcat10	< 10.1.23-1	tomcat10_10.1.23-1_all.deb
Debian	13	all	tomcat10	< 10.1.23-1	tomcat10_10.1.23-1_all.deb
Debian	12	all	tomcat9	< 9.0.70-2	tomcat9_9.0.70-2_all.deb
Debian	11	all	tomcat9	< 9.0.43-2~deb11u9	tomcat9_9.0.43-2~deb11u9_all.deb
Debian	10	all	tomcat9	< 9.0.31-1~deb10u6	tomcat9_9.0.31-1~deb10u6_all.deb
Debian	999	all	tomcat9	< 9.0.70-2	tomcat9_9.0.70-2_all.deb
Debian	13	all	tomcat9	< 9.0.70-2	tomcat9_9.0.70-2_all.deb