GitHub Advisoryadvisory · Maven

GHSA-cx6h-86xw-9x34 Apache Tomcat - Fix for CVE-2023-24998 was incomplete

HIGH Published 2023-07-06 Modified 2024-04-24 Official page ↗
Aliases
CVE-2023-28709
Ecosystem
Maven
Packages
org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat-coyote
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-193
Reviewed
2023-07-06

Affected packages

• Maven org.apache.tomcat.embed:tomcat-embed-core: >= 11.0.0-M2, < 11.0.0-M5 → fixed in 11.0.0-M5 • Maven org.apache.tomcat.embed:tomcat-embed-core: >= 10.1.5, < 10.1.8 → fixed in 10.1.8 • Maven org.apache.tomcat.embed:tomcat-embed-core: >= 9.0.71, < 9.0.74 → fixed in 9.0.74 • Maven org.apache.tomcat:tomcat-coyote: >= 8.5.85, < 8.5.88 → fixed in 8.5.88

Description

The fix for CVE-2023-24998 was incomplete. If non-default HTTP connector settings were used such that the maxParameterCount could be reached using query string parameters and a request was submitted that supplied exactly maxParameterCount parameters in the query string, the limit for uploaded request parts could be bypassed with the potential for a denial of service to occur.

Related

Alias · CVE (1)

  • CVE-2023-28709 The fix for CVE-2023-24998 was incomplete for Apache Tomcat 11.0.0-M2 to 11.0.0-M4, 10.1.5 to 10.1.7, 9.0.71 to 9.0.73 and 8.5.85 to 8.5.87. vulnerability

Weakness · CWE (1)

  • CWE-193 Off-by-one Error weakness

References