Lucene search

K

Veracode Vulnerability DatabaseVERACODE:45873

HistoryMar 15, 2024 - 6:11 a.m.

Denial Of Service (DoS)

2024-03-1506:11:57

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

20

denial of service

vulnerability

tomcat

websocket

improper cleanup

AI Score

6.5

Confidence

High

EPSS

0

Percentile

10.4%

org.apache.tomcat: tomcat-websocket is vulnerable to Denial of Service (DoS). The vulnerability is due to improper cleanup of WebSocket connections during a session timeout. If a client fails to send a close message within the timeout period, the websocket connection will continue to hold resources, which can result in Denial of Service.

Affected configurations

Vulners

Node

veracodetomcat-embed-websocketRange8.5.98–8.5.98

OR

veracodetomcat-embed-websocketRange9.0.85–9.0.85

OR

veracodetomcat-embed-websocketRange10.1.18–10.1.18

OR

veracodetomcat-embed-websocketRange11.0.0-M16–11.0.0-M16

OR

veracodetomcat-websocketRange11.0.0-M16–11.0.0-M16

OR

veracodetomcat-websocketRange10.1.18–10.1.18

OR

veracodetomcat-websocketRange9.0.85–9.0.85

OR

veracodetomcat-websocketRange8.5.98–8.5.98

OR

veracodetomcat9\Matchsid9.0.40-1

OR

veracodetomcat9\Matchbuster9.0.31-1~deb10u3

OR

veracodetomcat9\Matchbuster9.0.31-1~deb10u4

OR

veracodetomcat9\Matchbuster9.0.31-1~deb10u2

OR

veracodetomcat9\Matchbuster9.0.31-1~deb10u5

OR

veracodetomcat9\Matchbullseye9.0.43-1

OR

veracodetomcat-embed-websocketRange8.5.98–8.5.98

OR

veracodetomcat-embed-websocketRange9.0.85–9.0.85

OR

veracodetomcat-embed-websocketRange10.1.18–10.1.18

OR

veracodetomcat-embed-websocketRange11.0.0-M16–11.0.0-M16

OR

veracodetomcat-websocketRange11.0.0-M16–11.0.0-M16

OR

veracodetomcat-websocketRange10.1.18–10.1.18

OR

veracodetomcat-websocketRange9.0.85–9.0.85

OR

veracodetomcat-websocketRange8.5.98–8.5.98

OR

veracodetomcat9\Matchsid9.0.40-1

OR

veracodetomcat9\Matchbuster9.0.31-1~deb10u3

OR

veracodetomcat9\Matchbuster9.0.31-1~deb10u4

OR

veracodetomcat9\Matchbuster9.0.31-1~deb10u2

OR

veracodetomcat9\Matchbuster9.0.31-1~deb10u5

OR

veracodetomcat9\Matchbullseye9.0.43-1

VendorProductVersionCPE
veracodetomcat-embed-websocket*cpe:2.3:a:veracode:tomcat-embed-websocket:*:*:*:*:*:*:*:*
veracodetomcat-websocket*cpe:2.3:a:veracode:tomcat-websocket:*:*:*:*:*:*:*:*
veracodetomcat9\sidcpe:2.3:a:veracode:tomcat9\:sid:9.0.40-1:*:*:*:*:*:*:*
veracodetomcat9\bustercpe:2.3:a:veracode:tomcat9\:buster:9.0.31-1~deb10u3:*:*:*:*:*:*:*
veracodetomcat9\bustercpe:2.3:a:veracode:tomcat9\:buster:9.0.31-1~deb10u4:*:*:*:*:*:*:*
veracodetomcat9\bustercpe:2.3:a:veracode:tomcat9\:buster:9.0.31-1~deb10u2:*:*:*:*:*:*:*
veracodetomcat9\bustercpe:2.3:a:veracode:tomcat9\:buster:9.0.31-1~deb10u5:*:*:*:*:*:*:*
veracodetomcat9\bullseyecpe:2.3:a:veracode:tomcat9\:bullseye:9.0.43-1:*:*:*:*:*:*:*

References

www.openwall.com/lists/oss-security/2024/03/13/4

github.com/apache/tomcat/commit/b0e3b1bd78de270d53e319d7cb79eb282aa53cb9

lists.apache.org/thread/cmpswfx6tj4s7x0nxxosvfqs11lvdx2f

lists.debian.org/debian-lts-announce/2024/04/msg00001.html

lists.fedoraproject.org/archives/list/[email protected]/message/3UWIS5MMGYDZBLJYT674ZI5AWFHDZ46B/

lists.fedoraproject.org/archives/list/[email protected]/message/736G4GPZWS2DSQO5WKXO3G6OMZKFEK55/

security.netapp.com/advisory/ntap-20240402-0002/

tomcat.apache.org/security-10.html

tomcat.apache.org/security-11.html

tomcat.apache.org/security-8.html

tomcat.apache.org/security-9.html

AI Score

6.5

Confidence

High

EPSS

0

Percentile

10.4%

Related for VERACODE:45873