Lucene search

K
tomcatApache TomcatTOMCAT:656BFFE8230CF02C9C933FA9CF6CADDB
HistoryOct 10, 2023 - 12:00 a.m.

Fixed in Apache Tomcat 11.0.0-M12

2023-10-1000:00:00
Apache Tomcat
tomcat.apache.org
17
apache tomcat
http/2
request smuggling
denial of service
information disclosure

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

0.708 High

EPSS

Percentile

98.1%

Important: Request smuggling CVE-2023-45648

Tomcat did not correctly parse HTTP trailer headers. A specially crafted, invalid trailer header could cause Tomcat to treat a single request as multiple requests leading to the possibility of request smuggling when behind a reverse proxy.

This was fixed with commit eb5c094e.

This issue was reported to the Tomcat Security Team on 12 September 2023. The issue was made public on 10 October 2023.

Affects: 11.0.0-M1 to 11.0.0-M11

Important: Denial of Service CVE-2023-44487

Tomcat’s HTTP/2 implementation was vulnerable to the rapid reset attack. The denial of service typically manifested as an OutOfMemoryError.

This was fixed with commit 9cdfe25b.

This issue was reported to the Tomcat Security Team on 14 September 2023. The issue was made public on 10 October 2023.

Affects: 11.0.0-M1 to 11.0.0-M11

Important: Information Disclosure CVE-2023-42795

When recycling various internal objects, including the request and the response, prior to re-use by the next request/response, an error could cause Tomcat to skip some parts of the recycling process leading to information leaking from the current request/response to the next.

This was fixed with commit d6db22e4.

This issue was identified by the Tomcat Security Team on 13 September 2023. The issue was made public on 10 October 2023.

Affects: 11.0.0-M1 to 11.0.0-M11

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

0.708 High

EPSS

Percentile

98.1%