Audit Linux privileges now to limit compromise, escalation, and system-wide damage. Review Linux Privileges×

Alerts This Week
Warning Icon 1 498
Alerts This Week
Warning Icon 1 498

SUSE: 2023:4129-1 Important: Tomcat Security Issues Addressed

suse
Calendar Grey October 19, 2023
Scroller Suse
Crucial software enhancement for Tomcat focusing on critical vulnerabilities. Prioritize updates to preserve operational stability and security.
* bsc#1214666 * bsc#1216182 * jsc#PED-6376 * jsc#PED-6377

Summary

## This update for tomcat fixes the following issues: Tomcat was updated to version 9.0.82 (jsc#PED-6376, jsc#PED-6377): * Security issues fixed: * CVE-2023-41080: Avoid protocol relative redirects in FORM authentication. (bsc#1214666) * CVE-2023-44487: Fix HTTP/2 Rapid Reset Attack. (bsc#1216182) * Update to Tomcat 9.0.82: * Catalina * Add: 65770: Provide a lifecycle listener that will automatically reload TLS configurations a set time before the certificate is due to expire. This is intended to be used with third-party tools that regularly renew TLS certificates. * Fix: Fix handling of an error reading a context descriptor on deployment. * Fix: Fix rewrite rule qsd (query string discard) being ignored if qsa was also use, while it should instead take precedence.

Topics%20covered

Topics Covered

security advisory security issue tomcat suse important advisory dos mitigation httpprotocol

References

* bsc#1214666

* bsc#1216182

* jsc#PED-6376

* jsc#PED-6377

Cross-

* CVE-2023-41080

* CVE-2023-44487

CVSS scores:

* CVE-2023-41080 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

* CVE-2023-41080 ( NVD ): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

* CVE-2023-44487 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

* CVE-2023-44487 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected Products:

* SUSE Enterprise Storage 7.1

* SUSE Linux Enterprise High Performance Computing 15 SP2

* SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2

* SUSE Linux Enterprise High Performance Computing 15 SP3

* SUSE Linux Enterprise High Performance Computing 15 SP4

* SUSE Linux Enterprise High Performance Computing 15 SP5

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: SUSE-SU-2023:4129-1
Rating: important

Topics%20covered

Topics Covered

security advisory security issue tomcat suse important advisory dos mitigation httpprotocol

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.