Apache Tomcat: HTTP/2 excess header handling DoS
Résumé
Apache Tomcat: HTTP/2 excess header handling DoS
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Improper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache Tomcat. When processing an HTTP/2 stream, Tomcat did not handle some cases of excessive HTTP headers correctly. This led to a miscounting of active HTTP/2 streams which in turn led to the use of an incorrect infinite timeout which allowed connections to remain open which should have been closed.
This issue affects Apache Tomcat: from 11.0.0 through 11.0.0, from 10.1.0 through 10.1.24, from 9.0.0 through 9.0.89.
The following versions were EOL at the time the CVE was created but are
known to be affected: 8.5.0 though 8.5.100. Other EOL versions may also be affected.
Users are recommended to upgrade to version 11.0.0, 10.1.25 or 9.0.90, which fixes the issue.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Paquets affectés
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Debian DEBIAN-CVE-2024-34750 tomcat10 Corrigé dans: 10.1.34-0+deb12u1
- Ubuntu UBUNTU-CVE-2024-34750 tomcat9
Références
- advisory lists.apache.org
- advisory security.netapp.com
- web nvd.nist.gov
- web lists.debian.org
- web github.com
- web github.com
- web github.com