SUSE update for tomcat

1) Allocation of Resources Without Limits or Throttling

EUVDB-ID: #VU72427

Risk: Medium

CVSSv4.0: 7.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/U:Green]

CVE-ID: CVE-2023-24998

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to Apache Commons FileUpload does not limit the number of request parts. A remote attacker can initiate a series of uploads and perform a denial of service (DoS) attack.

Mitigation

Update the affected package tomcat to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Server for SAP Applications 15: SP1

SUSE Linux Enterprise Server 15 SP1 LTSS: 15-SP1

SUSE Linux Enterprise Server 15: SP1

SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS: 15-SP1

SUSE Linux Enterprise High Performance Computing 15: SP1

SUSE CaaS Platform: 4.0

tomcat-el-3_0-api: before 9.0.36-150100.4.87.1

tomcat: before 9.0.36-150100.4.87.1

tomcat-jsp-2_3-api: before 9.0.36-150100.4.87.1

tomcat-lib: before 9.0.36-150100.4.87.1

tomcat-servlet-4_0-api: before 9.0.36-150100.4.87.1

tomcat-webapps: before 9.0.36-150100.4.87.1

tomcat-admin-webapps: before 9.0.36-150100.4.87.1

CPE2.3

• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_15:SP1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_15_sp1_ltss:15-SP1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_15:SP1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_15_sp1_ltss:15-SP1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_15:SP1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_caas_platform:4.0:*:*:*:*:*:*:*
• cpe:2.3:a:suse:tomcat-el-3_0-api:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:tomcat:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:tomcat-jsp-2_3-api:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:tomcat-lib:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:tomcat-servlet-4_0-api:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:tomcat-webapps:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:a:suse:tomcat-admin-webapps:*:*:*:*:*:suse_linux:*:*

External links

https://www.suse.com/support/update/announcement/2023/suse-su-20230697-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.