Lucene search
RedHatRHSA-2024:3666HistoryJun 06, 2024 - 8:15 a.m.
(RHSA-2024:3666) Important: tomcat security and bug fix update
2024-06-0608:15:12
access.redhat.com
9
apache tomcat
servlet container
security fix
bug fix
http/2 header handling
websocket dos
cvss score
references section
jira:rhel-35813
jira:rhel-38548
cve-2024-24549
cve-2024-23672
EPSS
0
Percentile
14.8%
Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.
Security Fix(es):
-
Apache Tomcat: HTTP/2 header handling DoS (CVE-2024-24549)
-
Apache Tomcat: WebSocket DoS with incomplete closing handshake (CVE-2024-23672)
Bug Fix(es):
-
Rebase tomcat to version 9.0.87 (JIRA:RHEL-35813)
-
Amend tomcat package’s changelog so that fixed CVEs are mentioned explicitly (JIRA:RHEL-38548)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| RedHat | 8 | noarch | tomcat-servlet-4.0-api | < 9.0.87-1.el8_10.1 | tomcat-servlet-4.0-api-9.0.87-1.el8_10.1.noarch.rpm |
| RedHat | 8 | noarch | tomcat | < 9.0.87-1.el8_10.1 | tomcat-9.0.87-1.el8_10.1.noarch.rpm |
| RedHat | 8 | noarch | tomcat-lib | < 9.0.87-1.el8_10.1 | tomcat-lib-9.0.87-1.el8_10.1.noarch.rpm |
| RedHat | 8 | noarch | tomcat-jsp-2.3-api | < 9.0.87-1.el8_10.1 | tomcat-jsp-2.3-api-9.0.87-1.el8_10.1.noarch.rpm |
| RedHat | 8 | noarch | tomcat-docs-webapp | < 9.0.87-1.el8_10.1 | tomcat-docs-webapp-9.0.87-1.el8_10.1.noarch.rpm |
| RedHat | 8 | noarch | tomcat-el-3.0-api | < 9.0.87-1.el8_10.1 | tomcat-el-3.0-api-9.0.87-1.el8_10.1.noarch.rpm |
| RedHat | 8 | noarch | tomcat-webapps | < 9.0.87-1.el8_10.1 | tomcat-webapps-9.0.87-1.el8_10.1.noarch.rpm |
| RedHat | 8 | noarch | tomcat-admin-webapps | < 9.0.87-1.el8_10.1 | tomcat-admin-webapps-9.0.87-1.el8_10.1.noarch.rpm |
Related
debian
debian
[SECURITY] [DLA 3779-1] tomcat9 security update
2024-04-06 05:26:26
[SECURITY] [DSA 5665-1] tomcat10 security update
2024-04-17 22:03:15
[SECURITY] [DSA 5667-1] tomcat9 security update
2024-04-19 20:06:14
openvas
openvas
SUSE: Security Advisory (SUSE-SU-2024:1345-1)
2024-05-07 00:00:00
Apache Tomcat Multiple DoS Vulnerabilities (Mar 2024) - Windows
2024-03-13 00:00:00
Apache Tomcat Multiple DoS Vulnerabilities (Mar 2024) - Linux
2024-03-13 00:00:00
redhat
redhat
(RHSA-2024:3307) Important: tomcat security and bug fix update
2024-05-23 05:51:20
(RHSA-2024:3308) Important: tomcat security and bug fix update
2024-05-23 05:51:21
(RHSA-2024:3814) Important: tomcat security and bug fix update
2024-06-11 17:06:35
nessus
nessus
Fedora 40 : tomcat (2024-c404b99f19)
2024-06-23 00:00:00
Rocky Linux 9 : tomcat (RLSA-2024:3307)
2024-06-14 00:00:00
Apache Tomcat 11.0.0.M1 < 11.0.0.M17 multiple vulnerabilities
2024-03-13 00:00:00
almalinux
almalinux
Important: tomcat security and bug fix update
2024-06-06 00:00:00
Important: tomcat security and bug fix update
2024-05-23 00:00:00
tomcat
tomcat
Fixed in Apache Tomcat 9.0.86
2024-02-19 00:00:00
Fixed in Apache Tomcat 8.5.99
2024-02-19 00:00:00
Fixed in Apache Tomcat 10.1.19
2024-02-19 00:00:00
fedora
fedora
[SECURITY] Fedora 39 Update: tomcat-9.0.89-1.fc39
2024-06-13 03:03:35
[SECURITY] Fedora 40 Update: tomcat-9.0.89-1.fc40
2024-06-23 06:52:19
amazon
amazon
Important: tomcat8
2024-06-19 18:46:00
Important: tomcat
2024-04-11 01:07:00
oraclelinux
oraclelinux
tomcat security and bug fix update
2024-05-23 00:00:00
tomcat security and bug fix update
2024-06-06 00:00:00
rocky
rocky
tomcat security and bug fix update
2024-06-14 13:59:30
tomcat security and bug fix update
2024-06-14 14:00:40
osv
osv
Important: tomcat security and bug fix update
2024-06-14 13:59:30
tomcat9 - security update
2024-04-06 00:00:00
Important: tomcat security and bug fix update
2024-06-06 00:00:00
ibm
ibm
Security Bulletin: Apache Tomcat is vulnerable to CVE-2024-24549 and CVE-2024-23672 used in IBM Maximo Application Suite - Monitor Component
2024-05-02 19:25:53
mageia
mageia
Updated tomcat packages fix security vulnerabilities
2024-03-27 01:02:49
kaspersky
kaspersky
KLA65144 Multiple vulnerabilities in Apache Tomcat
2024-02-19 00:00:00
cnvd
cnvd
Apache Tomcat Denial of Service Vulnerability (CNVD-2024-13569)
2024-03-15 00:00:00
cve
cve
CVE-2024-23672
2024-03-13 16:15:29
CVE-2024-24549
2024-03-13 16:15:29
redos
redos
ROS-20240422-09
2024-04-22 00:00:00
ROS-20240703-12
2024-07-03 00:00:00
debiancve
debiancve
CVE-2024-23672
2024-03-13 16:15:29
CVE-2024-24549
2024-03-13 16:15:29
nvd
nvd
CVE-2024-23672
2024-03-13 16:15:29
CVE-2024-24549
2024-03-13 16:15:29
redhatcve
redhatcve
CVE-2024-23672
2024-03-14 21:39:59
CVE-2024-24549
2024-03-14 21:40:09
ubuntucve
ubuntucve
CVE-2024-23672
2024-03-13 00:00:00
CVE-2024-24549
2024-03-13 00:00:00
prion
prion
Input validation
2024-03-13 16:15:00
Input validation
2024-03-13 16:15:00
vulnrichment
vulnrichment
CVE-2024-24549 Apache Tomcat: HTTP/2 header handling DoS
2024-03-13 15:46:53
cvelist
cvelist
CVE-2024-24549 Apache Tomcat: HTTP/2 header handling DoS
2024-03-13 15:46:53
github
github
cgr
cgr
CVE-2024-23672 vulnerabilities
2024-05-19 03:07:16
CVE-2024-24549 vulnerabilities
2024-05-19 03:07:16
veracode
veracode
Denial Of Service (DoS)
2024-03-15 06:11:57
Denial Of Service (DoS)
2024-03-16 20:57:13
wolfi
wolfi
CVE-2024-23672 vulnerabilities
2024-09-16 09:11:42
CVE-2024-24549 vulnerabilities
2024-09-16 09:11:42
hackerone
hackerone
Internet Bug Bounty: Denial of Service caused by HTTP/2 CONTINUATION Flood
2024-01-25 12:51:50
githubexploit
githubexploit
Exploit for CVE-2024-24549
2024-08-02 21:05:34
thn
thn
New HTTP/2 Vulnerability Exposes Web Servers to DoS Attacks
2024-04-04 11:15:00
oracle
oracle
Oracle Critical Patch Update Advisory - July 2024
2024-07-16 00:00:00
Oracle Critical Patch Update Advisory - April 2024
2024-04-16 00:00:00