CVE-2024-23672

2024-03-1316:15:29

Debian Security Bug Tracker

security-tracker.debian.org

cve-2024-23672

apache tomcat

denial of service

websocket

resource consumption

upgrade

unix

7.2 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

14.6%

JSON

Denial of Service via incomplete cleanup vulnerability in Apache Tomcat. It was possible for WebSocket clients to keep WebSocket connections open leading to increased resource consumption.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, from 10.1.0-M1 through 10.1.18, from 9.0.0-M1 through 9.0.85, from 8.5.0 through 8.5.98. Users are recommended to upgrade to version 11.0.0-M17, 10.1.19, 9.0.86 or 8.5.99 which fix the issue.

OSVersionArchitecturePackageVersionFilename
Debian12alltomcat10< 10.1.6-1+deb12u2tomcat10_10.1.6-1+deb12u2_all.deb
Debian999alltomcat10< 10.1.20-1tomcat10_10.1.20-1_all.deb
Debian13alltomcat10< 10.1.20-1tomcat10_10.1.20-1_all.deb
Debian12alltomcat9< 9.0.70-2tomcat9_9.0.70-2_all.deb
Debian11alltomcat9< 9.0.43-2~deb11u10tomcat9_9.0.43-2~deb11u10_all.deb
Debian10alltomcat9< 9.0.31-1~deb10u12tomcat9_9.0.31-1~deb10u12_all.deb
Debian999alltomcat9< 9.0.70-2tomcat9_9.0.70-2_all.deb
Debian13alltomcat9< 9.0.70-2tomcat9_9.0.70-2_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	tomcat10	< 10.1.6-1+deb12u2	tomcat10_10.1.6-1+deb12u2_all.deb
Debian	999	all	tomcat10	< 10.1.20-1	tomcat10_10.1.20-1_all.deb
Debian	13	all	tomcat10	< 10.1.20-1	tomcat10_10.1.20-1_all.deb
Debian	12	all	tomcat9	< 9.0.70-2	tomcat9_9.0.70-2_all.deb
Debian	11	all	tomcat9	< 9.0.43-2~deb11u10	tomcat9_9.0.43-2~deb11u10_all.deb
Debian	10	all	tomcat9	< 9.0.31-1~deb10u12	tomcat9_9.0.31-1~deb10u12_all.deb
Debian	999	all	tomcat9	< 9.0.70-2	tomcat9_9.0.70-2_all.deb
Debian	13	all	tomcat9	< 9.0.70-2	tomcat9_9.0.70-2_all.deb