RHEL 9 : tomcat (RHSA-2024:1092)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:1092 advisory. Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages JSP technologies. Security Fixes: tomcat: HTTP request smuggling via...

Important Photon OS Security Update - PHSA-2024-3.0-0732

Updates of 'apache-tomcat', 'ruby' packages of Photon OS have been released...

Important Photon OS Security Update - PHSA-2024-4.0-0574

Updates of 'linux-aws', 'c-ares', 'apache-tomcat', 'linux-secure', 'linux-rt' packages of Photon OS have been released...

Apache Tomcat 8.5.7 < 8.5.64 Request Smuggling

The version of Apache Tomcat installed on the remote host is 8.5.7 to 8.5.63 and 9.0.0-M11 to 9.0.43. It is, therefore, affected by a request smuggling vulnerability. Note that the scanner has not attempted to exploit these issues but has instead relied only on the application's self-reported...

Apache Tomcat 9.0.0-M11 < 9.0.44 Request Smuggling

The version of Apache Tomcat installed on the remote host is 8.5.7 to 8.5.63 and 9.0.0-M11 to 9.0.43. It is, therefore, affected by a request smuggling vulnerability. Note that the scanner has not attempted to exploit these issues but has instead relied only on the application's self-reported...

HPESBMU04599 rev.1 - HPE IceWall products, Remote Disclosure of Information

Potential Security Impact: Remote: Disclosure of Information SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE IceWall Federation - 4.0 RHEL 8 and Windows - SAML IdP, Office 365 module, OIDC RP and OIDC OP. IceWall Gen11 Password Reset Option - 11.0 RHEL 8 and Windows IceWall...

Fixed in Apache Tomcat 8.5.99

Important: Denial of Service CVE-2024-23672 It was possible for a WebSocket client to keep a WebSocket connection open leading to increased resource consumption. This was fixed with commit 3631adb1. This issue was identified by the Tomcat Security Team on 17 January 2024. The issue was made publi...

Fixed in Apache Tomcat 10.1.19

Important: Denial of Service CVE-2024-23672 It was possible for a WebSocket client to keep a WebSocket connection open leading to increased resource consumption. This was fixed with commit 0052b374. This issue was identified by the Tomcat Security Team on 17 January 2024. The issue was made publi...

PT-2024-2566

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 11.0.0-M1 through 11.0.0-M16 Apache Tomcat versions 10.1.0-M1 through 10.1.18 Apache Tomcat versions 9.0.0-M1 through 9.0.85 Apache Tomcat versions 8.5.0 through 8.5.98 Description The issue is related to a Denial of...

KLA65144 Multiple vulnerabilities in Apache Tomcat

Multiple vulnerabilities were found in Apache Tomcat. Malicious users can exploit these vulnerabilities to cause denial of service. Below is a complete list of vulnerabilities: 1. A denial of service vulnerability in WebSocket client can be exploited remotely to cause denial of service. 2. A deni...

PT-2024-2570

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions prior to 11.0.0-M1, 10.1.0-M1, 9.0.0-M1, 8.5.0 through 8.5.98. Description The vulnerability in Apache Tomcat is due to improper input validation for HTTP/2 requests, leading to potential DoS conditions. If the request...

Fixed in Apache Tomcat 9.0.86

Important: Denial of Service CVE-2024-23672 It was possible for a WebSocket client to keep a WebSocket connection open leading to increased resource consumption. This was fixed with commit 52d6650e. This issue was identified by the Tomcat Security Team on 17 January 2024. The issue was made publi...

SUSE SLES15: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc (SUSE-SU-2024:0472-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:0472-1 advisory. Updated to Tomcat 9.0.85: - CVE-2023-45648: Improve trailer header parsing bsc1216118. - CVE-2023-42794: FileUpload:...

Security Bulletin: Due to use of Apache Tomcat, App Connect Professional is vulnerable to HTTP request smuggling.

Summary App Connect Professional has addressed the following vulnerability reported in Apache Tomcat. CVE-2023-46589 Vulnerability Details CVEID:CVE-2023-46589 DESCRIPTION: Apache Tomcat is vulnerable to HTTP request smuggling, caused by improper parsing of the HTTP trailer headers. By sending a...

The vulnerability of the Apache Tomcat application server, related to the inconsistent interpretation of HTTP requests, allows attackers to compromise the integrity of the protected information.

The vulnerability of the Apache Tomcat application server is related to the inconsistent interpretation of HTTP requests. Exploiting this vulnerability allows a malicious actor to compromise the integrity of the protected information...

PT-2024-19163 · Apache +1 · Apache Tomcat +1

Name of the Vulnerable Software and Affected Versions: Apache Tomcat affected versions not specified Description: The issue is related to insecure permissions in the packaging of Apache Tomcat, allowing local users to escalate to root if they win a race during package installation. This is a loca...

Rocky Linux 8 : tomcat (RLSA-2024:0539)

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2024:0539 advisory. - Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.1.15, from 9.0.0-M1 through 9.0.82...

Huawei EulerOS: Security Advisory for tomcat (EulerOS-SA-2024-1166)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS 2.0 SP5 : tomcat (EulerOS-SA-2024-1166)

According to the versions of the tomcat packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Incomplete Cleanup vulnerability in Apache Tomcat.When recycling various internal objects in Apache Tomcat from 11.0.0-M1 through 11.0.0-M11, fr...

CentOS 8 : tomcat (CESA-2023:7065)

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2023:7065 advisory. - tomcat: Fix for was incomplete CVE-2023-24998 - When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the...