Lucene search

Debian Security Bug TrackerDEBIANCVE:CVE-2024-23672

HistoryMar 13, 2024 - 4:15 p.m.

CVE-2024-23672

2024-03-1316:15:29

Debian Security Bug Tracker

security-tracker.debian.org

cve-2024-23672

apache tomcat

denial of service

websocket

resource consumption

upgrade

unix

AI Score

7.2

Confidence

High

EPSS

Percentile

10.4%

JSON

Denial of Service via incomplete cleanup vulnerability in Apache Tomcat. It was possible for WebSocket clients to keep WebSocket connections open leading to increased resource consumption.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, from 10.1.0-M1 through 10.1.18, from 9.0.0-M1 through 9.0.85, from 8.5.0 through 8.5.98. Users are recommended to upgrade to version 11.0.0-M17, 10.1.19, 9.0.86 or 8.5.99 which fix the issue.

OSVersionArchitecturePackageVersionFilename
Debian12alltomcat10< 10.1.6-1+deb12u2tomcat10_10.1.6-1+deb12u2_all.deb
Debian999alltomcat10< 10.1.20-1tomcat10_10.1.20-1_all.deb
Debian13alltomcat10< 10.1.20-1tomcat10_10.1.20-1_all.deb
Debian12alltomcat9< 9.0.70-2tomcat9_9.0.70-2_all.deb
Debian11alltomcat9< 9.0.43-2~deb11u10tomcat9_9.0.43-2~deb11u10_all.deb
Debian999alltomcat9< 9.0.70-2tomcat9_9.0.70-2_all.deb
Debian13alltomcat9< 9.0.70-2tomcat9_9.0.70-2_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	tomcat10	< 10.1.6-1+deb12u2	tomcat10_10.1.6-1+deb12u2_all.deb
Debian	999	all	tomcat10	< 10.1.20-1	tomcat10_10.1.20-1_all.deb
Debian	13	all	tomcat10	< 10.1.20-1	tomcat10_10.1.20-1_all.deb
Debian	12	all	tomcat9	< 9.0.70-2	tomcat9_9.0.70-2_all.deb
Debian	11	all	tomcat9	< 9.0.43-2~deb11u10	tomcat9_9.0.43-2~deb11u10_all.deb
Debian	999	all	tomcat9	< 9.0.70-2	tomcat9_9.0.70-2_all.deb
Debian	13	all	tomcat9	< 9.0.70-2	tomcat9_9.0.70-2_all.deb