Advisories » MGASA-2024-0267

Updated tomcat packages fix security vulnerability

Publication date: 15 Jul 2024
Modification date: 15 Jul 2024
Type: security
Affected Mageia releases : 9
CVE: CVE-2024-34750

Description

Improper Handling of Exceptional Conditions, Uncontrolled Resource
Consumption vulnerability in Apache Tomcat. When processing an HTTP/2
stream, Tomcat did not handle some cases of excessive HTTP headers
correctly. This led to a miscounting of active HTTP/2 streams which in
turn led to the use of an incorrect infinite timeout which allowed
connections to remain open which should have been closed.
(CVE-2024-34750)
                

References

• https://bugs.mageia.org/show_bug.cgi?id=33367
• https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.90
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-34750

SRPMS

9/core

• tomcat-9.0.90-1.mga9