Lucene search
HistoryOct 10, 2023 - 6:15 p.m.
CVE-2023-42795
apache tomcat
incomplete cleanup
vulnerability
5.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
6.4 Medium
AI Score
Confidence
High
0.01 Low
EPSS
Percentile
83.5%
Incomplete Cleanup vulnerability in Apache Tomcat.When recycling various internal objects in Apache Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.80 and from 8.5.0 through 8.5.93, an error could
cause Tomcat to skip some parts of the recycling process leading to
information leaking from the current request/response to the next.
Users are recommended to upgrade to version 11.0.0-M12 onwards, 10.1.14 onwards, 9.0.81 onwards or 8.5.94 onwards, which fixes the issue.
Affected configurations
Node
apachetomcatRange8.5.0–8.5.94
ORapachetomcatRange9.0.1–9.0.81
ORapachetomcatRange10.1.1–10.1.14
ORapachetomcatMatch9.0.0milestone1
ORapachetomcatMatch9.0.0milestone10
ORapachetomcatMatch9.0.0milestone11
ORapachetomcatMatch9.0.0milestone12
ORapachetomcatMatch9.0.0milestone13
ORapachetomcatMatch9.0.0milestone14
ORapachetomcatMatch9.0.0milestone15
ORapachetomcatMatch9.0.0milestone16
ORapachetomcatMatch9.0.0milestone17
ORapachetomcatMatch9.0.0milestone18
ORapachetomcatMatch9.0.0milestone19
ORapachetomcatMatch9.0.0milestone2
ORapachetomcatMatch9.0.0milestone20
ORapachetomcatMatch9.0.0milestone21
ORapachetomcatMatch9.0.0milestone22
ORapachetomcatMatch9.0.0milestone23
ORapachetomcatMatch9.0.0milestone24
ORapachetomcatMatch9.0.0milestone25
ORapachetomcatMatch9.0.0milestone26
ORapachetomcatMatch9.0.0milestone27
ORapachetomcatMatch9.0.0milestone3
ORapachetomcatMatch9.0.0milestone4
ORapachetomcatMatch9.0.0milestone5
ORapachetomcatMatch9.0.0milestone6
ORapachetomcatMatch9.0.0milestone7
ORapachetomcatMatch9.0.0milestone8
ORapachetomcatMatch9.0.0milestone9
ORapachetomcatMatch10.1.0milestone1
ORapachetomcatMatch10.1.0milestone10
ORapachetomcatMatch10.1.0milestone11
ORapachetomcatMatch10.1.0milestone12
ORapachetomcatMatch10.1.0milestone13
ORapachetomcatMatch10.1.0milestone14
ORapachetomcatMatch10.1.0milestone15
ORapachetomcatMatch10.1.0milestone16
ORapachetomcatMatch10.1.0milestone17
ORapachetomcatMatch10.1.0milestone18
ORapachetomcatMatch10.1.0milestone19
ORapachetomcatMatch10.1.0milestone2
ORapachetomcatMatch10.1.0milestone20
ORapachetomcatMatch10.1.0milestone3
ORapachetomcatMatch10.1.0milestone4
ORapachetomcatMatch10.1.0milestone5
ORapachetomcatMatch10.1.0milestone6
ORapachetomcatMatch10.1.0milestone7
ORapachetomcatMatch10.1.0milestone8
ORapachetomcatMatch10.1.0milestone9
ORapachetomcatMatch11.0.0milestone1
ORapachetomcatMatch11.0.0milestone10
ORapachetomcatMatch11.0.0milestone11
ORapachetomcatMatch11.0.0milestone2
ORapachetomcatMatch11.0.0milestone3
ORapachetomcatMatch11.0.0milestone4
ORapachetomcatMatch11.0.0milestone5
ORapachetomcatMatch11.0.0milestone6
ORapachetomcatMatch11.0.0milestone7
ORapachetomcatMatch11.0.0milestone8
ORapachetomcatMatch11.0.0milestone9
Node
debiandebian_linuxMatch10.0
ORdebiandebian_linuxMatch11.0
ORdebiandebian_linuxMatch12.0
Related
cvelist
cvelist
ibm
ibm
debiancve
debiancve
CVE-2023-42795
2023-10-10 18:15:18
osv
osv
Apache Tomcat Incomplete Cleanup vulnerability
2023-10-10 18:31:35
BIT-tomcat-2023-42795
2024-03-06 11:08:01
CVE-2023-42795
2023-10-10 18:15:18
openvas
openvas
Huawei EulerOS: Security Advisory for tomcat (EulerOS-SA-2024-1166)
2024-02-09 00:00:00
Mageia: Security Advisory (MGASA-2023-0319)
2023-11-16 00:00:00
SUSE: Security Advisory (SUSE-SU-2023:4337-1)
2023-11-03 00:00:00
ubuntucve
ubuntucve
CVE-2023-42795
2023-10-10 00:00:00
veracode
veracode
Information Disclosure
2023-10-12 14:31:47
redhatcve
redhatcve
CVE-2023-42795
2023-10-24 03:27:08
nessus
nessus
EulerOS 2.0 SP5 : tomcat (EulerOS-SA-2024-1166)
2024-02-08 00:00:00
F5 Networks BIG-IP : Apache Tomcat vulnerability (K000138178)
2024-01-17 00:00:00
SUSE SLES12 Security Update : tomcat (SUSE-SU-2023:4337-1)
2023-11-03 00:00:00
f5
f5
K000138178 : Apache Tomcat vulnerability CVE-2023-42795
2024-01-17 00:00:00
github
github
Apache Tomcat Incomplete Cleanup vulnerability
2023-10-10 18:31:35
cve
cve
CVE-2023-42795
2023-10-10 18:15:18
prion
prion
Input validation
2023-10-10 18:15:00
redhat
redhat
(RHSA-2023:6207) Moderate: Red Hat JBoss Web Server 5.7.6 release and security update
2023-10-31 13:03:48
(RHSA-2023:6206) Moderate: Red Hat JBoss Web Server 5.7.6 release and security update
2023-10-31 13:03:53
(RHSA-2024:0125) Moderate: tomcat security update
2024-01-10 09:29:51
mageia
mageia
Updated tomcat packages fix security vulnerabilities
2023-11-15 14:35:09
amazon
amazon
Important: tomcat8
2023-10-16 13:45:00
qualysblog
qualysblog
CVE-2023-44487 HTTP/2 Rapid Reset Attack
2023-10-10 22:01:49
kaspersky
kaspersky
KLA61362 Multiple vulnerabilities in Apache Tomcat
2023-10-10 00:00:00
KLA61363 Multiple vulnerabilities in Apache Tomcat
2023-10-10 00:00:00
tomcat
tomcat
Fixed in Apache Tomcat 11.0.0-M12
2023-10-10 00:00:00
Fixed in Apache Tomcat 10.1.14
2023-10-10 00:00:00
Fixed in Apache Tomcat 9.0.81
2023-10-10 00:00:00
almalinux
almalinux
Moderate: tomcat security update
2024-01-25 00:00:00
Moderate: tomcat security update
2024-01-10 00:00:00
oraclelinux
oraclelinux
tomcat security update
2024-01-25 00:00:00
tomcat security update
2024-01-11 00:00:00
redos
redos
ROS-20240405-12
2024-04-05 00:00:00
debian
debian
[SECURITY] [DSA 5521-1] tomcat10 security update
2023-10-10 22:09:33
[SECURITY] [DLA 3617-1] tomcat9 security update
2023-10-13 13:58:32
[SECURITY] [DSA 5522-1] tomcat9 security update
2023-10-10 22:11:02
rosalinux
rosalinux
Advisory ROSA-SA-2024-2418
2024-05-14 08:49:00
oracle
oracle
Oracle Critical Patch Update Advisory - January 2024
2024-01-16 00:00:00
5.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
6.4 Medium
AI Score
Confidence
High
0.01 Low
EPSS
Percentile
83.5%
Related for NVD:CVE-2023-42795