Debian: DSA-5845-1 critical: tomcat10 denial-of-service advisories

Several problems have been addressed in Tomcat 10, a Java based web server,
servlet and JSP engine which may lead to a denial-of-service.


CVE-2024-38286

Apache Tomcat, under certain configurations, allows an attacker to cause an
OutOfMemoryError by abusing the TLS handshake process.

CVE-2024-52316

Unchecked Error Condition vulnerability in Apache Tomcat. If Tomcat is
configured to use a custom Jakarta Authentication (formerly JASPIC)
ServerAuthContext component which may throw an exception during the
authentication process without explicitly setting an HTTP status to
indicate failure, the authentication may not fail, allowing the user to
bypass the authentication process. There are no known Jakarta
Authentication components that behave in this way.

CVE-2024-50379 / CVE-2024-56337

Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP
compilation in Apache Tomcat permits an RCE on case insensitive file
systems when the default servl...