MEDIUM 6.3
GHSA-v682-8vv8-vpwr
Denial of Service via incomplete cleanup vulnerability in Apache Tomcat
빠른 조치
GHSA-v682-8vv8-vpwr — org.apache.tomcat:tomcat-websocket: 아래 명령으로 수정 버전으로 올리세요.
# pom.xml: bump <version>11.0.0-M17</version> for org.apache.tomcat:tomcat-websocket상세
Denial of Service via incomplete cleanup vulnerability in Apache Tomcat. It was possible for WebSocket clients to keep WebSocket connections open leading to increased resource consumption.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, from 10.1.0-M1 through 10.1.18, from 9.0.0-M1 through 9.0.85, from 8.5.0 through 8.5.98. Older, EOL versions may also be affected.
Users are recommended to upgrade to version 11.0.0-M17, 10.1.19, 9.0.86 or 8.5.99 which fix the issue.
이 버전이 영향받나요?
사용 중인 패키지 버전을 입력하면 즉시 평가합니다.
영향 패키지
Maven / org.apache.tomcat:tomcat-websocket
최초 영향 버전:
11.0.0-M1 수정 버전: 11.0.0-M17 수정
# pom.xml: bump <version>11.0.0-M17</version> for org.apache.tomcat:tomcat-websocket Maven / org.apache.tomcat:tomcat-websocket
최초 영향 버전:
10.1.0-M1 수정 버전: 10.1.19 수정
# pom.xml: bump <version>10.1.19</version> for org.apache.tomcat:tomcat-websocket Maven / org.apache.tomcat:tomcat-websocket
최초 영향 버전:
9.0.0-M1 수정 버전: 9.0.86 수정
# pom.xml: bump <version>9.0.86</version> for org.apache.tomcat:tomcat-websocket Maven / org.apache.tomcat:tomcat-websocket
최초 영향 버전:
8.5.0 수정 버전: 8.5.99 수정
# pom.xml: bump <version>8.5.99</version> for org.apache.tomcat:tomcat-websocket Maven / org.apache.tomcat.embed:tomcat-embed-websocket
최초 영향 버전:
11.0.0-M1 수정 버전: 11.0.0-M17 수정
# pom.xml: bump <version>11.0.0-M17</version> for org.apache.tomcat.embed:tomcat-embed-websocket Maven / org.apache.tomcat.embed:tomcat-embed-websocket
최초 영향 버전:
10.1.0-M1 수정 버전: 10.1.19 수정
# pom.xml: bump <version>10.1.19</version> for org.apache.tomcat.embed:tomcat-embed-websocket Maven / org.apache.tomcat.embed:tomcat-embed-websocket
최초 영향 버전:
9.0.0-M1 수정 버전: 9.0.86 수정
# pom.xml: bump <version>9.0.86</version> for org.apache.tomcat.embed:tomcat-embed-websocket Maven / org.apache.tomcat.embed:tomcat-embed-websocket
최초 영향 버전:
8.5.0 수정 버전: 8.5.99 수정
# pom.xml: bump <version>8.5.99</version> for org.apache.tomcat.embed:tomcat-embed-websocket 참고
- https://nvd.nist.gov/vuln/detail/CVE-2024-23672 [ADVISORY]
- https://github.com/apache/tomcat/commit/0052b374684b613b0c849899b325ebe334ac6501 [WEB]
- https://github.com/apache/tomcat/commit/3631adb1342d8bbd8598802a12b63ad02c37d591 [WEB]
- https://github.com/apache/tomcat/commit/52d6650e062d880704898d7d8c1b2b7a3efe8068 [WEB]
- https://github.com/apache/tomcat/commit/b0e3b1bd78de270d53e319d7cb79eb282aa53cb9 [WEB]
- https://github.com/apache/tomcat [PACKAGE]
- https://lists.apache.org/thread/cmpswfx6tj4s7x0nxxosvfqs11lvdx2f [WEB]
- https://lists.debian.org/debian-lts-announce/2024/04/msg00001.html [WEB]
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3UWIS5MMGYDZBLJYT674ZI5AWFHDZ46B [WEB]
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/736G4GPZWS2DSQO5WKXO3G6OMZKFEK55 [WEB]
- https://security.netapp.com/advisory/ntap-20240402-0002 [WEB]
- http://www.openwall.com/lists/oss-security/2024/03/13/4 [WEB]