CVE-2024-23672

NameCVE-2024-23672
DescriptionDenial of Service via incomplete cleanup vulnerability in Apache Tomcat. It was possible for WebSocket clients to keep WebSocket connections open leading to increased resource consumption.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, from 10.1.0-M1 through 10.1.18, from 9.0.0-M1 through 9.0.85, from 8.5.0 through 8.5.98. Users are recommended to upgrade to version 11.0.0-M17, 10.1.19, 9.0.86 or 8.5.99 which fix the issue.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-3779-1, DSA-5665-1
Debian Bugs1066877

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
tomcat10 (PTS)bookworm10.1.6-1+deb12u1vulnerable
bookworm (security)10.1.6-1+deb12u2fixed
trixie, sid10.1.20-1fixed
tomcat9 (PTS)buster9.0.31-1~deb10u6vulnerable
buster (security)9.0.31-1~deb10u12fixed
bullseye (security), bullseye9.0.43-2~deb11u9vulnerable
trixie, sid, bookworm9.0.70-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
tomcat10sourcebookworm10.1.6-1+deb12u2DSA-5665-1
tomcat10source(unstable)10.1.20-11066877
tomcat9sourcebuster9.0.31-1~deb10u12DLA-3779-1
tomcat9source(unstable)9.0.70-2

Notes

https://lists.apache.org/thread/cmpswfx6tj4s7x0nxxosvfqs11lvdx2f
https://github.com/apache/tomcat/commit/0052b374684b613b0c849899b325ebe334ac6501 (10.1.19)
https://github.com/apache/tomcat/commit/52d6650e062d880704898d7d8c1b2b7a3efe8068 (9.0.86)
Starting with 9.0.70-2 Tomcat9 no longer ships the server stack, using that as the fixed version

Search for package or bug name: Reporting problems