MGASA-2023-0319

See a problem?
Please try reporting it to the source first.
Source
https://advisories.mageia.org/MGASA-2023-0319.html
Import Source
https://advisories.mageia.org/MGASA-2023-0319.json
JSON Data
https://api.osv.dev/v1/vulns/MGASA-2023-0319
Related
Published
2023-11-15T11:35:09Z
Modified
2023-11-15T10:10:17Z
Summary
Updated tomcat packages fix security vulnerabilities
Details

The updated packages fix security vulnerabilities:

Incomplete Cleanup vulnerability in Apache Tomcat.When recycling various internal objects in Apache Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.80 and from 8.5.0 through 8.5.93, an error could cause Tomcat to skip some parts of the recycling process leading to information leaking from the current request/response to the next. (CVE-2023-42795)

Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.81 and from 8.5.0 through 8.5.93 did not correctly parse HTTP trailer headers. A specially crafted, invalid trailer header could cause Tomcat to treat a single request as multiple requests leading to the possibility of request smuggling when behind a reverse proxy. (CVE-2023-45648)

References
Credits

Affected packages

Mageia:9 / tomcat

Package

Name
tomcat
Purl
pkg:rpm/mageia/tomcat?distro=mageia-9

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
9.0.82-1.mga9

Ecosystem specific 

{
    "section": "core"
}

Mageia:8 / tomcat

Package

Name
tomcat
Purl
pkg:rpm/mageia/tomcat?distro=mageia-8

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
9.0.82-1.mga8

Ecosystem specific 

{
    "section": "core"
}