Bugzilla – Bug 1221385
VUL-0: CVE-2024-23672: tomcat,tomcat10: WebSocket DoS with incomplete closing handshake
Last modified: 2024-07-17 10:16:09 UTC
Denial of Service via incomplete cleanup vulnerability in Apache Tomcat. It was possible for WebSocket clients to keep WebSocket connections open leading to increased resource consumption.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, from 10.1.0-M1 through 10.1.18, from 9.0.0-M1 through 9.0.85, from 8.5.0 through 8.5.98. Users are recommended to upgrade to version 11.0.0-M17, 10.1.19, 9.0.86 or 8.5.99 which fix the issue. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-23672 https://www.cve.org/CVERecord?id=CVE-2024-23672 https://seclists.org/oss-sec/2024/q1/226 https://lists.apache.org/thread/cmpswfx6tj4s7x0nxxosvfqs11lvdx2f
https://tomcat.apache.org/security-8.html Affects: 8.5.0 to 8.5.98 Fix: https://github.com/apache/tomcat/commit/3631adb1342d8bbd8598802a12b63ad02c37d591 https://tomcat.apache.org/security-9.html Affects: 9.0.0-M1 to 9.0.85 Fix: https://github.com/apache/tomcat/commit/52d6650e062d880704898d7d8c1b2b7a3efe8068 https://tomcat.apache.org/security-10.html Affects: 10.1.0-M1 to 10.1.18 Fix: https://github.com/apache/tomcat/commit/0052b374684b613b0c849899b325ebe334ac6501
SUSE-SU-2024:1205-1: An update that solves two vulnerabilities can now be installed. Category: security (important) Bug References: 1221385, 1221386 CVE References: CVE-2024-23672, CVE-2024-24549 Maintenance Incident: [SUSE:Maintenance:33319](https://smelt.suse.de/incident/33319/) Sources used: SUSE Linux Enterprise High Performance Computing 12 SP5 (src): tomcat-9.0.36-3.124.1 SUSE Linux Enterprise Server 12 SP5 (src): tomcat-9.0.36-3.124.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5 (src): tomcat-9.0.36-3.124.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2024:1204-1: An update that solves two vulnerabilities can now be installed. Category: security (important) Bug References: 1221385, 1221386 CVE References: CVE-2024-23672, CVE-2024-24549 Maintenance Incident: [SUSE:Maintenance:33312](https://smelt.suse.de/incident/33312/) Sources used: openSUSE Leap 15.5 (src): tomcat10-10.1.20-150200.5.22.2 Web and Scripting Module 15-SP5 (src): tomcat10-10.1.20-150200.5.22.2 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2024:1345-1: An update that solves two vulnerabilities can now be installed. Category: security (important) Bug References: 1221385, 1221386 CVE References: CVE-2024-23672, CVE-2024-24549 Maintenance Incident: [SUSE:Maintenance:33133](https://smelt.suse.de/incident/33133/) Sources used: openSUSE Leap 15.5 (src): apache-commons-pool2-2.4.2-150200.11.8.1, apache-commons-daemon-1.3.4-150200.11.14.1, geronimo-specs-1.2-150200.15.8.1, apache-commons-dbcp-2.1.1-150200.10.8.1, tomcat-9.0.87-150200.65.1, jakarta-taglibs-standard-1.1.1-150000.4.10.1 Development Tools Module 15-SP5 (src): geronimo-specs-1.2-150200.15.8.1 SUSE Package Hub 15 15-SP5 (src): geronimo-specs-1.2-150200.15.8.1 SUSE Manager Server 4.3 Module 4.3 (src): geronimo-specs-1.2-150200.15.8.1 Web and Scripting Module 15-SP5 (src): apache-commons-pool2-2.4.2-150200.11.8.1, apache-commons-daemon-1.3.4-150200.11.14.1, geronimo-specs-1.2-150200.15.8.1, apache-commons-dbcp-2.1.1-150200.10.8.1, tomcat-9.0.87-150200.65.1, jakarta-taglibs-standard-1.1.1-150000.4.10.1 SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (src): apache-commons-pool2-2.4.2-150200.11.8.1, apache-commons-daemon-1.3.4-150200.11.14.1, geronimo-specs-1.2-150200.15.8.1, apache-commons-dbcp-2.1.1-150200.10.8.1, tomcat-9.0.87-150200.65.1, jakarta-taglibs-standard-1.1.1-150000.4.10.1 SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (src): apache-commons-pool2-2.4.2-150200.11.8.1, apache-commons-daemon-1.3.4-150200.11.14.1, geronimo-specs-1.2-150200.15.8.1, apache-commons-dbcp-2.1.1-150200.10.8.1, tomcat-9.0.87-150200.65.1, jakarta-taglibs-standard-1.1.1-150000.4.10.1 SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (src): apache-commons-pool2-2.4.2-150200.11.8.1, apache-commons-daemon-1.3.4-150200.11.14.1, geronimo-specs-1.2-150200.15.8.1, apache-commons-dbcp-2.1.1-150200.10.8.1, tomcat-9.0.87-150200.65.1, jakarta-taglibs-standard-1.1.1-150000.4.10.1 SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (src): apache-commons-pool2-2.4.2-150200.11.8.1, apache-commons-daemon-1.3.4-150200.11.14.1, geronimo-specs-1.2-150200.15.8.1, apache-commons-dbcp-2.1.1-150200.10.8.1, tomcat-9.0.87-150200.65.1, jakarta-taglibs-standard-1.1.1-150000.4.10.1 SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 (src): geronimo-specs-1.2-150200.15.8.1 SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (src): apache-commons-pool2-2.4.2-150200.11.8.1, apache-commons-daemon-1.3.4-150200.11.14.1, geronimo-specs-1.2-150200.15.8.1, apache-commons-dbcp-2.1.1-150200.10.8.1, tomcat-9.0.87-150200.65.1, jakarta-taglibs-standard-1.1.1-150000.4.10.1 SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (src): apache-commons-pool2-2.4.2-150200.11.8.1, apache-commons-daemon-1.3.4-150200.11.14.1, geronimo-specs-1.2-150200.15.8.1, apache-commons-dbcp-2.1.1-150200.10.8.1, tomcat-9.0.87-150200.65.1, jakarta-taglibs-standard-1.1.1-150000.4.10.1 SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 (src): apache-commons-pool2-2.4.2-150200.11.8.1, apache-commons-daemon-1.3.4-150200.11.14.1, geronimo-specs-1.2-150200.15.8.1, apache-commons-dbcp-2.1.1-150200.10.8.1, tomcat-9.0.87-150200.65.1, jakarta-taglibs-standard-1.1.1-150000.4.10.1 SUSE Linux Enterprise Server for SAP Applications 15 SP2 (src): apache-commons-pool2-2.4.2-150200.11.8.1, apache-commons-daemon-1.3.4-150200.11.14.1, geronimo-specs-1.2-150200.15.8.1, apache-commons-dbcp-2.1.1-150200.10.8.1, tomcat-9.0.87-150200.65.1, jakarta-taglibs-standard-1.1.1-150000.4.10.1 SUSE Linux Enterprise Server for SAP Applications 15 SP3 (src): apache-commons-pool2-2.4.2-150200.11.8.1, apache-commons-daemon-1.3.4-150200.11.14.1, geronimo-specs-1.2-150200.15.8.1, apache-commons-dbcp-2.1.1-150200.10.8.1, tomcat-9.0.87-150200.65.1, jakarta-taglibs-standard-1.1.1-150000.4.10.1 SUSE Linux Enterprise Server for SAP Applications 15 SP4 (src): apache-commons-pool2-2.4.2-150200.11.8.1, apache-commons-daemon-1.3.4-150200.11.14.1, geronimo-specs-1.2-150200.15.8.1, apache-commons-dbcp-2.1.1-150200.10.8.1, tomcat-9.0.87-150200.65.1, jakarta-taglibs-standard-1.1.1-150000.4.10.1 SUSE Manager Server 4.3 (src): apache-commons-pool2-2.4.2-150200.11.8.1, apache-commons-daemon-1.3.4-150200.11.14.1, geronimo-specs-1.2-150200.15.8.1, apache-commons-dbcp-2.1.1-150200.10.8.1, tomcat-9.0.87-150200.65.1, jakarta-taglibs-standard-1.1.1-150000.4.10.1 SUSE Enterprise Storage 7.1 (src): apache-commons-pool2-2.4.2-150200.11.8.1, apache-commons-daemon-1.3.4-150200.11.14.1, geronimo-specs-1.2-150200.15.8.1, apache-commons-dbcp-2.1.1-150200.10.8.1, tomcat-9.0.87-150200.65.1, jakarta-taglibs-standard-1.1.1-150000.4.10.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
The SR for SUSE:ALP:Source:Standard:1.0 are here https://build.suse.de/request/show/325915 https://build.suse.de/request/show/325916 but they're not accepted yet. @fstrba Are the SR ok or should I create them for src.suse.de ? Is there any guide for this new mechanism (in particular when we're doing a sync with factory) ? Thanks
(In reply to Michele Bussolotto from comment #9) > The SR for SUSE:ALP:Source:Standard:1.0 are here > https://build.suse.de/request/show/325915 > https://build.suse.de/request/show/325916 > > but they're not accepted yet. > > @fstrba > Are the SR ok or should I create them for src.suse.de ? Is there any guide > for this new mechanism (in particular when we're doing a sync with factory) ? > > Thanks They look good. I just ping-ed them on slack. Let us see how quickly it will go.