Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
osvGoogleOSV:RLSA-2024:3666
HistoryJun 14, 2024 - 1:59 p.m.

Important: tomcat security and bug fix update

2024-06-1413:59:30
Google
osv.dev
1
apache tomcat
servlet container
java servlet
javaserver pages
security fix
http/2
websocket dos
bug fix
update
cve-2024-24549
cve-2024-23672
version 9.0.87

6.6 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

15.5%

JSON

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

Security Fix(es):

  • Apache Tomcat: HTTP/2 header handling DoS (CVE-2024-24549)

  • Apache Tomcat: WebSocket DoS with incomplete closing handshake (CVE-2024-23672)

Bug Fix(es):

  • Rebase tomcat to version 9.0.87 (JIRA:Rocky Linux-35813)

  • Amend tomcat package’s changelog so that fixed CVEs are mentioned explicitly (JIRA:Rocky Linux-38548)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Related

tomcat 4
nessus 35
mageia 1
ibm 14
debian 3
openvas 10
redhat 10
almalinux 2
osv 10
rocky 1
oraclelinux 2
fedora 1
kaspersky 1
debiancve 2
redos 1
nvd 2
redhatcve 2
cnvd 1
cve 2
hackerone 1
github 2
cvelist 2
veracode 2
cgr 2
amazon 1
wolfi 2
ubuntucve 2
prion 2
thn 1
oracle 1
tomcat
tomcat
Fixed in Apache Tomcat 8.5.99
2024-02-19 00:00:00
Fixed in Apache Tomcat 9.0.86
2024-02-19 00:00:00
Fixed in Apache Tomcat 11.0.0-M17
2024-02-19 00:00:00
nessus
nessus
Amazon Linux 2023 : tomcat9, tomcat9-admin-webapps, tomcat9-el-3.0-api (ALAS2023-2024-577)
2024-04-03 00:00:00
RHEL 9 : tomcat (RHSA-2024:3307)
2024-05-23 00:00:00
Amazon Linux 2 : tomcat (ALASTOMCAT9-2024-013)
2024-04-18 00:00:00
mageia
mageia
Updated tomcat packages fix security vulnerabilities
2024-03-27 01:02:49
ibm
ibm
Security Bulletin: Vulnerabilities in Apache Tomcat affect IBM SAN Volume Controller, IBM Storwize, IBM Storage Virtualize and IBM FlashSystem products
2024-06-19 15:29:31
Security Bulletin: Apache Tomcat is vulnerable to CVE-2024-24549 and CVE-2024-23672 used in IBM Maximo Application Suite - Monitor Component
2024-05-02 19:25:53
Security Bulletin: Multiple vulnerabilities in Apache Tomcat affects App Connect Professional
2024-05-17 11:21:50
debian
debian
[SECURITY] [DLA 3779-1] tomcat9 security update
2024-04-06 05:26:26
[SECURITY] [DSA 5665-1] tomcat10 security update
2024-04-17 22:03:15
[SECURITY] [DSA 5667-1] tomcat9 security update
2024-04-19 20:06:14
openvas
openvas
SUSE: Security Advisory (SUSE-SU-2024:1345-1)
2024-05-07 00:00:00
Mageia: Security Advisory (MGASA-2024-0090)
2024-04-05 00:00:00
Debian: Security Advisory (DLA-3779-1)
2024-04-08 00:00:00
redhat
redhat
(RHSA-2024:3308) Important: tomcat security and bug fix update
2024-05-23 05:51:21
(RHSA-2024:3307) Important: tomcat security and bug fix update
2024-05-23 05:51:20
(RHSA-2024:1916) Important: Red Hat JBoss Web Server 6.0.2 release and security update
2024-05-07 12:59:16
almalinux
almalinux
Important: tomcat security and bug fix update
2024-06-06 00:00:00
Important: tomcat security and bug fix update
2024-05-23 00:00:00
osv
osv
tomcat9 - security update
2024-04-06 00:00:00
Important: tomcat security and bug fix update
2024-05-23 00:00:00
Important: tomcat security and bug fix update
2024-06-06 00:00:00
rocky
rocky
tomcat security and bug fix update
2024-06-14 14:00:40
oraclelinux
oraclelinux
tomcat security and bug fix update
2024-05-23 00:00:00
tomcat security and bug fix update
2024-06-06 00:00:00
fedora
fedora
[SECURITY] Fedora 39 Update: tomcat-9.0.89-1.fc39
2024-06-13 03:03:35
kaspersky
kaspersky
KLA65144 Multiple vulnerabilities in Apache Tomcat
2024-02-19 00:00:00
debiancve
debiancve
CVE-2024-23672
2024-03-13 16:15:29
CVE-2024-24549
2024-03-13 16:15:29
redos
redos
ROS-20240422-09
2024-04-22 00:00:00
nvd
nvd
CVE-2024-23672
2024-03-13 16:15:29
CVE-2024-24549
2024-03-13 16:15:29
redhatcve
redhatcve
CVE-2024-23672
2024-03-14 21:39:59
CVE-2024-24549
2024-03-14 21:40:09
cnvd
cnvd
Apache Tomcat Denial of Service Vulnerability (CNVD-2024-13569)
2024-03-15 00:00:00
cve
cve
CVE-2024-23672
2024-03-13 16:15:29
CVE-2024-24549
2024-03-13 16:15:29
hackerone
hackerone
Internet Bug Bounty: Denial of Service caused by HTTP/2 CONTINUATION Flood
2024-01-25 12:51:50
github
github
Apache Tomcat Denial of Service due to improper input validation vulnerability for HTTP/2 requests
2024-03-13 18:31:34
Denial of Service via incomplete cleanup vulnerability in Apache Tomcat
2024-03-13 18:31:34
cvelist
cvelist
CVE-2024-24549 Apache Tomcat: HTTP/2 header handling DoS
2024-03-13 15:46:53
CVE-2024-23672 Apache Tomcat: WebSocket DoS with incomplete closing handshake
2024-03-13 15:48:42
veracode
veracode
Denial Of Service (DoS)
2024-03-15 06:11:57
Denial Of Service (DoS)
2024-03-16 20:57:13
cgr
cgr
CVE-2024-23672 vulnerabilities
2024-05-19 03:07:16
CVE-2024-24549 vulnerabilities
2024-05-19 03:07:16
amazon
amazon
Important: tomcat
2024-04-11 01:07:00
wolfi
wolfi
CVE-2024-23672 vulnerabilities
2024-06-19 15:18:09
CVE-2024-24549 vulnerabilities
2024-06-19 15:18:09
ubuntucve
ubuntucve
CVE-2024-23672
2024-03-13 00:00:00
CVE-2024-24549
2024-03-13 00:00:00
prion
prion
Input validation
2024-03-13 16:15:00
Input validation
2024-03-13 16:15:00
thn
thn
New HTTP/2 Vulnerability Exposes Web Servers to DoS Attacks
2024-04-04 11:15:00
oracle
oracle
Oracle Critical Patch Update Advisory - April 2024
2024-04-16 00:00:00

6.6 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

15.5%

JSON
Related for OSV:RLSA-2024:3666
tomcat4nessus35mageia1ibm14debian3openvas10redhat10almalinux2osv10rocky1oraclelinux2fedora1kaspersky1debiancve2redos1nvd2redhatcve2cnvd1cve2hackerone1github2cvelist2veracode2cgr2amazon1wolfi2ubuntucve2prion2thn1oracle1