Apache Tomcat 8.5.0 to 8.5.63, 9.0.0-M1 to 9.0.43 and 10.0.0-M1 to 10.0.2 did not properly validate incoming TLS packets. When Tomcat was configured t...

原文の説明

取得元が公開している説明をそのまま載せています (多くは英語)。

Apache Tomcat 8.5.0 to 8.5.63, 9.0.0-M1 to 9.0.43 and 10.0.0-M1 to 10.0.2 did not properly validate incoming TLS packets. When Tomcat was configured to use NIO+OpenSSL or NIO2+OpenSSL for TLS, a specially crafted packet could be used to trigger an infinite loop resulting in a denial of service.

出典: OSV.dev (Open Source Vulnerabilities) OSV

影響パッケージ

Debian:12 tomcat9

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.53-1"}]}]

Debian:13 tomcat9

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.53-1"}]}]

Debian:14 tomcat9

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.53-1"}]}]

参照URL

advisory security-tracker.debian.org