Threats Tagged 'ubuntu-pro-24-04-lts'

A denial of service vulnerability exists in Apache Tomcat due to incomplete cleanup of WebSocket connections. WebSocket clients could keep connections open, causing increased resource consumption. This affects multiple Apache Tomcat versions from 8.5.0 through 8.5.98, 9.0.0-M1 through 9.0.85, 10.1.0-M1 through 10.1.18, and 11.0.0-M1 through 11.0.0-M16. Users are advised to upgrade to fixed versions 8.5.99, 9.0.86, 10.1.19, or 11.0.0-M17 to address the issue.

Apache Tomcat versions from 11.0.0-M1 through 11.0.0-M20, 10.1.0-M1 through 10.1.24, and 9.0.13 through 9.0.89, as well as certain end-of-life versions, contain a vulnerability that allows resource allocation without limits or throttling. This can be exploited via the TLS handshake process to cause an OutOfMemoryError, potentially leading to denial of service. Fixed versions include 11.0.0-M21, 10.1.25, and 9.0.90.

A vulnerability in Apache Tomcat allows authentication bypass if a custom Jakarta Authentication ServerAuthContext component throws an exception without setting an HTTP failure status. No known Jakarta Authentication components currently behave this way. The issue affects multiple Apache Tomcat versions including 8.5.0 through 8.5.100, 9.0.0-M1 through 9.0.95, 10.1.0-M1 through 10.1.30, and 11.0.0-M1 through 11.0.0-M26. Users should upgrade to fixed versions 11.0.0, 10.1.31, or 9.0.96 to address this vulnerability.

An uncontrolled resource consumption vulnerability exists in the examples web application provided with Apache Tomcat, which can lead to denial of service. This affects multiple Apache Tomcat versions including 8.5.0 through 8.5.100, 9.0.0.M1 through 9.9.97, 10.1.0-M1 through 10.1.33, and 11.0.0-M1 through 11.0.1. Users are advised to upgrade to fixed versions 11.0.2, 10.1.34, or 9.0.98 to remediate the issue.

A vulnerability in Apache Tomcat allows bypassing certain rewrite rules under specific, unlikely configurations. This could lead to bypassing security constraints enforced by those rewrite rules. The issue affects multiple versions of Apache Tomcat, including versions from 8.5.0 through 8.5.100, 9.0.0.M1 through 9.0.102, 10.1.0-M1 through 10.1.39, and 11.0.0-M1 through 11.0.5. Users are advised to upgrade to a fixed version to address this vulnerability.

An improper handling of case sensitivity vulnerability exists in Apache Tomcat's CGI servlet, allowing bypass of security constraints applied to the pathInfo component of a URI. This affects multiple Apache Tomcat versions including 11.0.0-M1 through 11.0.6, 10.1.0-M1 through 10.1.40, 9.0.0-M1 through 9.0.104, and some older EOL versions such as 8.5.0 through 8.5.100. The issue is fixed in versions 11.0.7, 10.1.41, and 9.0.105. Users should upgrade to these fixed versions to address the vulnerability.

A resource allocation vulnerability exists in Apache Tomcat versions from 11.0.0-M1 through 11.0.7, 10.1.0-M1 through 10.1.41, and 9.0.0.M1 through 9.0.105, including some older EOL versions such as 8.5.0 through 8.5.100. This flaw allows allocation of resources without limits or throttling, potentially leading to denial of service. Fixed versions are 11.0.8, 10.1.42, and 9.0.106. The vulnerability affects multiple Ubuntu package versions as listed. No known exploits in the wild have been reported.

An Improper Resource Shutdown or Release vulnerability exists in Apache Tomcat, affecting versions from 11.0.0-M1 through 11.0.9, 10.1.0-M1 through 10.1.43, and 9.0.0-M1 through 9.0.107. This vulnerability is known as the 'made you reset' attack. Users are advised to upgrade to versions 11.0.10, 10.1.44, or 9.0.108 where the issue is fixed.

An Integer Overflow vulnerability in Apache Tomcat affects certain multipart upload configurations, potentially allowing denial of service (DoS) by bypassing size limits. This impacts multiple Apache Tomcat versions from 6.0.37-1 through 11.0.8, including some end-of-life versions. The issue is fixed in Apache Tomcat versions 11.0.9, 10.1.43, and 9.0.107. Users are advised to upgrade to these fixed versions to mitigate the risk.

An uncontrolled resource consumption vulnerability exists in Apache Tomcat HTTP/2 handling where a client that does not acknowledge the initial settings frame can cause the server to allow more concurrent streams than intended. This affects multiple Apache Tomcat versions including 8.5.x, 9.0.x, 10.1.x, and 11.0.x branches. The issue is fixed in Apache Tomcat versions 11.0.9, 10.1.43, and 9.0.107. Users are advised to upgrade to these or later versions to mitigate the vulnerability.