Alerts This Week
Warning Icon 1 764
Alerts This Week
Warning Icon 1 764

Debian 11: DLA-4017-1 Urgent: tomcat9 Denial of Service and Data Leak

debian lts
Calendar Grey January 16, 2025
Dist Debian Esm H88
Stay informed on recent security patches for Tomcat 9 that tackle significant denial-of-service vulnerabilities and prevent unauthorized access to sensitive data.
Several problems have been addressed in Tomcat 9, a Java based web server, servlet and JSP engine which may lead to a denial-of-service or the disclosure of sensitive information
Topics%20covered

Topics Covered

security advisory denial of service security update Debian information disclosure tomcat RCE

Summary

CVE-2024-21733

Generation of Error Message Containing Sensitive Information vulnerability
in Apache Tomcat.

CVE-2024-38286

Apache Tomcat, under certain configurations, allows an attacker to cause an
OutOfMemoryError by abusing the TLS handshake process.

CVE-2024-52316

Unchecked Error Condition vulnerability in Apache Tomcat. If Tomcat is
configured to use a custom Jakarta Authentication (formerly JASPIC)
ServerAuthContext component which may throw an exception during the
authentication process without explicitly setting an HTTP status to
indicate failure, the authentication may not fail, allowing the user to
bypass the authentication process. There are no known Jakarta
Authentication components that behave in this way.

CVE-2024-50379 / CVE-2024-56337

Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP
compilation in Apache Tomcat permits an RCE on case insensitive file

Read the Full Advisory


Severity
important
Lowest
Low
Medium
High
Critical

Package: tomcat9
Version: 9.0.43-2~deb11u11
CVE ID: CVE-2024-21733 CVE-2024-38286 CVE-2024-50379 CVE-2024-52316

Topics%20covered

Topics Covered

security advisory denial of service security update Debian information disclosure tomcat RCE

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here