SUSE-SU-2024:0472-1 Security update for tomcat

This update for tomcat fixes the following issues: Updated to Tomcat 9.0.85: - CVE-2023-45648: Improve trailer header parsing bsc1216118. - CVE-2023-42794: FileUpload: remove tmp files to avoid DoS on Windows bsc1216120. - CVE-2023-42795: Improve handling of failures during recycle methods...

Medium: tomcat9

Issue Overview: Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.1.15, from 9.0.0-M1 through 9.0.82 and from 8.5.0 through 8.5.95 did not correctly parse HTTP trailer headers. A trailer header that exceeded the header siz...

Internet Bug Bounty: Possibility of Request smuggling attack

A vulnerability in Apache Tomcat allowed request smuggling due to incorrect parsing of HTTP trailer headers. A specially crafted trailer header exceeding the size limit could cause Tomcat to treat a single request as multiple requests, enabling request smuggling attacks when behind a reverse prox...

OESA-2023-1788 tomcat security update

The Apache Tomcat software is developed in an open and participatory environment and released under the Apache License version 2. The Apache Tomcat project is intended to be a collaboration of the best-of-breed developers from around the world. We invite you to participate in this open developmen...

CVE-2023-45648

A flaw was found in Apache Tomcat, where an improper input validation can occur. This flaw allows a malicious user to send a crafted request containing an invalid trailer header, which could be treated as multiple requests, potentially leading to request smuggling when behind a reverse proxy...

Apache Tomcat 11.0.0.M1 < 11.0.0.M12 multiple vulnerabilities

The version of Tomcat installed on the remote host is prior to 11.0.0.M12. It is, therefore, affected by multiple vulnerabilities as referenced in the fixedinapachetomcat11.0.0-m12security-11 advisory. - Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through...

Denial Of Service (DoS)

podium is vulnerable to denial of service DoS attacks. An attacker is able to cause denial of service conditions when using the Trailer header as part of the request against proxy endpoints...

Finn.no Podium 安全漏洞

Finn.no Podium is a library for building micro front ends from Finn.no Norway. A security vulnerability in Finn.no Podium layout prior to 4.6.110 and Podium proxy prior to 4.2.74 allows an attacker to shut down a server using the Trailer header as part of a request to the proxy endpoint...