Amazon Linux 2023 : tomcat10, tomcat10-admin-webapps, tomcat10-el-5.0-api (ALAS2023-2025-814)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-814 advisory. Time-of-check Time-of-use TOCTOU Race Condition vulnerability during JSP compilation in Apache Tomcat permits an RCE on case insensitive file systems when the default servlet is enabled for wri...

CVE-2024-52318 Apache Tomcat: Incorrect JSP tag recycling leads to XSS

Incorrect object recycling and reuse vulnerability in Apache Tomcat. This issue affects Apache Tomcat: 11.0.0, 10.1.31, 9.0.96. Users are recommended to upgrade to version 11.0.1, 10.1.32 or 9.0.97, which fixes the issue...

CVE-2024-52317

Apache Tomcat contains an incorrect object re-cycling and re-use vulnerability in its HTTP/2 implementation. The root cause is the improper recycling of request and response resources, which can lead to a request and/or response mix-up between different users. This vulnerability is particularly c...