跳转到帖子

Red Hat: CVE-2024-38286: tomcat: Denial of Service in Tomcat (Multiple Advisories)

recommended_posts

发布于
  • Members

Red Hat: CVE-2024-38286: tomcat: Denial of Service in Tomcat (Multiple Advisories)

Severity
8
CVSS
(AV:N/AC:L/Au:N/C:N/I:N/A:C)
Published
09/23/2024
Created
11/01/2024
Added
10/31/2024
Modified
11/11/2024

Description

Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from 9.0.13 through 9.0.89. Older, unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.0-M21, 10.1.25, or 9.0.90, which fixes the issue. Apache Tomcat, under certain configurations on any platform, allows an attacker to cause an OutOfMemoryError by abusing the TLS handshake process.

Solution(s)

  • redhat-upgrade-apache-commons-collections
  • redhat-upgrade-apache-commons-lang
  • redhat-upgrade-apache-commons-net
  • redhat-upgrade-bea-stax-api
  • redhat-upgrade-glassfish-fastinfoset
  • redhat-upgrade-glassfish-jaxb-api
  • redhat-upgrade-glassfish-jaxb-core
  • redhat-upgrade-glassfish-jaxb-runtime
  • redhat-upgrade-glassfish-jaxb-txw2
  • redhat-upgrade-idm-pki-acme
  • redhat-upgrade-idm-pki-base
  • redhat-upgrade-idm-pki-base-java
  • redhat-upgrade-idm-pki-ca
  • redhat-upgrade-idm-pki-kra
  • redhat-upgrade-idm-pki-server
  • redhat-upgrade-idm-pki-symkey
  • redhat-upgrade-idm-pki-symkey-debuginfo
  • redhat-upgrade-idm-pki-tools
  • redhat-upgrade-idm-pki-tools-debuginfo
  • redhat-upgrade-jackson-annotations
  • redhat-upgrade-jackson-core
  • redhat-upgrade-jackson-databind
  • redhat-upgrade-jackson-jaxrs-json-provider
  • redhat-upgrade-jackson-jaxrs-providers
  • redhat-upgrade-jackson-module-jaxb-annotations
  • redhat-upgrade-jakarta-commons-httpclient
  • redhat-upgrade-javassist
  • redhat-upgrade-javassist-javadoc
  • redhat-upgrade-jss
  • redhat-upgrade-jss-debuginfo
  • redhat-upgrade-jss-debugsource
  • redhat-upgrade-jss-javadoc
  • redhat-upgrade-ldapjdk
  • redhat-upgrade-ldapjdk-javadoc
  • redhat-upgrade-pki-core-debuginfo
  • redhat-upgrade-pki-core-debugsource
  • redhat-upgrade-pki-servlet-4-0-api
  • redhat-upgrade-pki-servlet-engine
  • redhat-upgrade-python-nss-debugsource
  • redhat-upgrade-python-nss-doc
  • redhat-upgrade-python3-idm-pki
  • redhat-upgrade-python3-nss
  • redhat-upgrade-python3-nss-debuginfo
  • redhat-upgrade-relaxngdatatype
  • redhat-upgrade-resteasy
  • redhat-upgrade-slf4j
  • redhat-upgrade-slf4j-jdk14
  • redhat-upgrade-stax-ex
  • redhat-upgrade-tomcatjss
  • redhat-upgrade-velocity
  • redhat-upgrade-xalan-j2
  • redhat-upgrade-xerces-j2
  • redhat-upgrade-xml-commons-apis
  • redhat-upgrade-xml-commons-resolver
  • redhat-upgrade-xmlstreambuffer
  • redhat-upgrade-xsom

References

  • CVE-2024-38286
  • RHSA-2024:8494
  • RHSA-2024:8528
  • RHSA-2024:8543
  • 查看数 692
  • 已创建
  • 最后回复

参与讨论

你可立刻发布并稍后注册。 如果你有帐户,立刻登录发布帖子。

游客
回帖…