Advisories » MGASA-2023-0319

Updated tomcat packages fix security vulnerabilities

Publication date: 15 Nov 2023
Modification date: 15 Nov 2023
Type: security
Affected Mageia releases : 8 , 9
CVE: CVE-2023-42795 , CVE-2023-45648

Description

The updated packages fix security vulnerabilities:

Incomplete Cleanup vulnerability in Apache Tomcat.When recycling various
internal objects in Apache Tomcat from 11.0.0-M1 through 11.0.0-M11,
from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.80 and from
8.5.0 through 8.5.93, an error could cause Tomcat to skip some parts of
the recycling process leading to information leaking from the current
request/response to the next. (CVE-2023-42795)

Improper Input Validation vulnerability in Apache Tomcat.Tomcat from
11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from
9.0.0-M1 through 9.0.81 and from 8.5.0 through 8.5.93 did not correctly
parse HTTP trailer headers. A specially crafted, invalid trailer header
could cause Tomcat to treat a single request as multiple requests
leading to the possibility of request smuggling when behind a reverse
proxy. (CVE-2023-45648)
                

References

• https://bugs.mageia.org/show_bug.cgi?id=32377
• https://www.openwall.com/lists/oss-security/2023/10/10/9
• https://www.openwall.com/lists/oss-security/2023/10/10/10
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-42795
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45648

SRPMS

9/core

• tomcat-9.0.82-1.mga9

8/core

• tomcat-9.0.82-1.mga8