Alerts This Week
Warning Icon 1 923
Alerts This Week
Warning Icon 1 923

Mageia 8 MGASA-2023-0191 Critical: Apache Tomcat DoS Risk Mitigated

mageia
Calendar Grey May 31, 2023
Dist Mageia Esm H88
Mageia 2023-0192 updates nginx resolving an unaddressed vulnerability that may allow remote code execution under specific conditions.
The fix for CVE-2023-24998 was incomplete for Apache Tomcat 11.0.0-M2 to 11.0.0-M4, 10.1.5 to 10.1.7, 9.0.71 to 9.0.73 and 8.5.85 to 8.5.87

Summary

The fix for CVE-2023-24998 was incomplete for Apache Tomcat 11.0.0-M2 to 11.0.0-M4, 10.1.5 to 10.1.7, 9.0.71 to 9.0.73 and 8.5.85 to 8.5.87. If non-default HTTP connector settings were used such that the maxParameterCount could be reached using query string parameters and a request was submitted that supplied exactly maxParameterCount parametersin the query string, the limit for uploaded request parts could be bypassed with the potential for a denial of service to occur. (CVE-2023-28709)

References

- https://bugs.mageia.org/show_bug.cgi?id=31951

- https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.74

- https://www.cve.org/CVERecord?id=CVE-2023-28709

Topics%20covered

Topics Covered

security advisory denial of service security issue critical software update tomcat mageia

Resolution

SRPMS

- 8/core/tomcat-9.0.74-1.mga8

Severity
critical
Lowest
Low
Medium
High
Critical

Publication date: 31 May 2023
URL: https://advisories.mageia.org/MGASA-2023-0191.html
Type: security
CVE: CVE-2023-28709

Topics%20covered

Topics Covered

security advisory denial of service security issue critical software update tomcat mageia

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here