Threats Tagged 'ubuntu-pro-22-04-lts'

A denial of service vulnerability exists in Apache Tomcat due to incomplete cleanup of WebSocket connections. WebSocket clients could keep connections open, causing increased resource consumption. This affects multiple Apache Tomcat versions from 8.5.0 through 8.5.98, 9.0.0-M1 through 9.0.85, 10.1.0-M1 through 10.1.18, and 11.0.0-M1 through 11.0.0-M16. Users are advised to upgrade to fixed versions 8.5.99, 9.0.86, 10.1.19, or 11.0.0-M17 to address the issue.

Apache Tomcat versions from 11.0.0-M1 through 11.0.0-M20, 10.1.0-M1 through 10.1.24, and 9.0.13 through 9.0.89, as well as certain end-of-life versions, contain a vulnerability that allows resource allocation without limits or throttling. This can be exploited via the TLS handshake process to cause an OutOfMemoryError, potentially leading to denial of service. Fixed versions include 11.0.0-M21, 10.1.25, and 9.0.90.

A vulnerability in Apache Tomcat allows authentication bypass if a custom Jakarta Authentication ServerAuthContext component throws an exception without setting an HTTP failure status. No known Jakarta Authentication components currently behave this way. The issue affects multiple Apache Tomcat versions including 8.5.0 through 8.5.100, 9.0.0-M1 through 9.0.95, 10.1.0-M1 through 10.1.30, and 11.0.0-M1 through 11.0.0-M26. Users should upgrade to fixed versions 11.0.0, 10.1.31, or 9.0.96 to address this vulnerability.

An uncontrolled resource consumption vulnerability exists in the examples web application provided with Apache Tomcat, which can lead to denial of service. This affects multiple Apache Tomcat versions including 8.5.0 through 8.5.100, 9.0.0.M1 through 9.9.97, 10.1.0-M1 through 10.1.33, and 11.0.0-M1 through 11.0.1. Users are advised to upgrade to fixed versions 11.0.2, 10.1.34, or 9.0.98 to remediate the issue.

An improper input validation vulnerability exists in the generic SSO login functionality of the Sympa product. This issue could potentially allow unexpected or malformed input to be processed, which may lead to security risks depending on the context of use. No specific affected versions or detailed impact scenarios are provided. There is no CVSS score or vendor advisory available at this time.

A Time-of-check Time-of-use (TOCTOU) race condition vulnerability exists in Apache Tomcat affecting multiple versions including 8.5.0 through 8.5.100, 9.0.0.M1 through 9.0.97, 10.1.0-M1 through 10.1.33, and 11.0.0-M1 through 11.0.1. The vulnerability relates to the default servlet write capability on case insensitive file systems and requires specific Java system property configurations to mitigate. Later Tomcat versions (9.0.99, 10.1.35, 11.0.3) include checks and default settings to address this issue. Users must configure the system property sun.io.useCanonCaches appropriately depending on their Java version to fully mitigate the vulnerability.

A vulnerability in Apache Tomcat allows bypassing certain rewrite rules under specific, unlikely configurations. This could lead to bypassing security constraints enforced by those rewrite rules. The issue affects multiple versions of Apache Tomcat, including versions from 8.5.0 through 8.5.100, 9.0.0.M1 through 9.0.102, 10.1.0-M1 through 10.1.39, and 11.0.0-M1 through 11.0.5. Users are advised to upgrade to a fixed version to address this vulnerability.

An improper handling of case sensitivity vulnerability exists in Apache Tomcat's CGI servlet, allowing bypass of security constraints applied to the pathInfo component of a URI. This affects multiple Apache Tomcat versions including 11.0.0-M1 through 11.0.6, 10.1.0-M1 through 10.1.40, 9.0.0-M1 through 9.0.104, and some older EOL versions such as 8.5.0 through 8.5.100. The issue is fixed in versions 11.0.7, 10.1.41, and 9.0.105. Users should upgrade to these fixed versions to address the vulnerability.

A resource allocation vulnerability exists in Apache Tomcat versions from 11.0.0-M1 through 11.0.7, 10.1.0-M1 through 10.1.41, and 9.0.0.M1 through 9.0.105, including some older EOL versions such as 8.5.0 through 8.5.100. This flaw allows allocation of resources without limits or throttling, potentially leading to denial of service. Fixed versions are 11.0.8, 10.1.42, and 9.0.106. The vulnerability affects multiple Ubuntu package versions as listed. No known exploits in the wild have been reported.

An Improper Resource Shutdown or Release vulnerability exists in Apache Tomcat, affecting versions from 11.0.0-M1 through 11.0.9, 10.1.0-M1 through 10.1.43, and 9.0.0-M1 through 9.0.107. This vulnerability is known as the 'made you reset' attack. Users are advised to upgrade to versions 11.0.10, 10.1.44, or 9.0.108 where the issue is fixed.