CVE-2023-28709

NameCVE-2023-28709
DescriptionThe fix for CVE-2023-24998 was incomplete for Apache Tomcat 11.0.0-M2 to 11.0.0-M4, 10.1.5 to 10.1.7, 9.0.71 to 9.0.73 and 8.5.85 to 8.5.87. If non-default HTTP connector settings were used such that the maxParameterCount could be reached using query string parameters and a request was submitted that supplied exactly maxParameterCount parameters in the query string, the limit for uploaded request parts could be bypassed with the potential for a denial of service to occur.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDSA-5521-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
tomcat10 (PTS)bookworm10.1.6-1+deb12u1fixed
bookworm (security)10.1.6-1+deb12u2fixed
trixie, sid10.1.23-1fixed
tomcat9 (PTS)buster9.0.31-1~deb10u6fixed
buster (security)9.0.31-1~deb10u12fixed
bullseye9.0.43-2~deb11u9fixed
bullseye (security)9.0.43-2~deb11u10fixed
trixie, bookworm, sid9.0.70-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
tomcat10sourceexperimental10.1.8-1
tomcat10sourcebookworm10.1.6-1+deb12u1DSA-5521-1
tomcat10source(unstable)10.1.10-1
tomcat9source(unstable)(not affected)

Notes

- tomcat9 <not-affected> (Incomplete fix for CVE-2023-24998 not applied)
https://github.com/apache/tomcat/commit/ba848da71c523d94950d3c53c19ea155189df9dc (10.1.8)
https://github.com/apache/tomcat/commit/fbd81421629afe8b8a3922d59020cde81caea861 (9.0.74)

Search for package or bug name: Reporting problems