Resource management error in Apache Tomcat - CVE-2024-52317

Vulnerability identifier: #VU100587

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-52317

CWE-ID: CWE-399

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to improper management of internal resources when handling HTTP/2 responses, which causes request and/or response mix-up between users. A remote non-authenticated attacker can send a series of HTTP/2 requests and gain access to sensitive information.

Apache Tomcat
SUSE Linux Enterprise Server 15 SP5
SUSE Linux Enterprise Server 15 SP3
SUSE Linux Enterprise Server 15 SP4
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Manager Server
SUSE Enterprise Storage
Web and Scripting Module
openSUSE Leap
Ubuntu
IBM Cloud Pak for Security
IBM Process Mining
EasyApache
IBM UrbanCode Release
IBM Rational Build Forge
IBM Power Hardware Management Console (HMC)
NetWorker
APEX Cloud Platform for Red Hat OpenShift
IBM Watson Discovery for IBM Cloud Pak for Data
QRadar Suite
IBM Security SOAR
Cloudera Observability with IBM
DevOps
IBM Business Automation Manager Open Editions
CICS Transaction Gateway Desktop Edition
Integration Bus for z/OS
CICS Transaction Gateway for Multiplatforms
webMethods developer portal
APEX Cloud Platform for Microsoft Azure
Storage Copy Data Management
watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component
watsonx Assistant Cartridge
IBM QRadar Incident Forensics
Storage Protect Plus Server
Traffix SDC
Cloudera Data Platform Private Cloud Base for IBM
Dell EMC VxRail Appliance
APROL
IBM Qradar SIEM
watsonx.data
tomcat
tomcat-admin-webapps
tomcat-embed
tomcat-lib
tomcat-docs-webapp
tomcat-jsp-2_3-api
tomcat-servlet-4_0-api
tomcat-webapps
tomcat-el-3_0-api
tomcat-jsvc
tomcat-javadoc
tomcat10 (Ubuntu package)
tomcat10-doc
tomcat10-el-5_0-api
tomcat10-jsp-3_1-api
tomcat10-webapps
tomcat10-admin-webapps
tomcat10-docs-webapp
tomcat10
tomcat10-embed
tomcat10-lib
tomcat10-jsvc
tomcat10-servlet-6_0-api

Install updates from vendor's website.

Apache Tomcat - addressed in versions 9.0.96, 10.1.31, 11.0.0
IBM Cloud Pak for Security - update to 1.11.3.0
QRadar Suite - update to 1.11.3.0
IBM Process Mining - update to 2.0
Cloudera Observability with IBM - update to 3.6.2
EasyApache - update to 4 2024-11-20
DevOps - update to 7.0.0.4
IBM Business Automation Manager Open Editions - update to 8.0.8
Dell EMC VxRail Appliance - update to 8.321
IBM Rational Build Forge - update to 8.0.0.28
IBM Power Hardware Management Console (HMC) - addressed in versions 10.2.1040.0 SP3, 10.3.1060.0 SP1
webMethods developer portal - update to 11.1.6
NetWorker - update to 19.13.0.1
APROL - update to R 4.4-01P5
APEX Cloud Platform for Microsoft Azure - update to 01.04.01.00
watsonx.data - update to 2.1.1
Storage Copy Data Management - update to 2.2.26.0
APEX Cloud Platform for Red Hat OpenShift - update to 03.02.04.00
IBM Watson Discovery for IBM Cloud Pak for Data - addressed in versions 4.8.8, 5.1.0
watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component - update to 5.1.1
watsonx Assistant Cartridge - update to 5.1.1
IBM Qradar SIEM - update to 7.5.0 Update Pack 10 IF02
IBM QRadar Incident Forensics - update to 7.5.0 UP10 IF02
tomcat - update to 9.0.98-150200.74.1
tomcat-admin-webapps - update to 9.0.98-150200.74.1
tomcat-embed - update to 9.0.98-150200.74.1
tomcat-lib - update to 9.0.98-150200.74.1
tomcat-docs-webapp - update to 9.0.98-150200.74.1
tomcat-jsp-2_3-api - update to 9.0.98-150200.74.1
tomcat-servlet-4_0-api - update to 9.0.98-150200.74.1
tomcat-webapps - update to 9.0.98-150200.74.1
tomcat-el-3_0-api - update to 9.0.98-150200.74.1
tomcat-jsvc - update to 9.0.98-150200.74.1
tomcat-javadoc - update to 9.0.98-150200.74.1
tomcat10 (Ubuntu package) - addressed in versions 10.1.16-1ubuntu0.1~esm3, 10.1.35-1ubuntu0.1
Storage Protect Plus Server - update to 10.1.18
tomcat10-doc - update to 10.1.34-150200.5.31.1
tomcat10-el-5_0-api - update to 10.1.34-150200.5.31.1
tomcat10-jsp-3_1-api - update to 10.1.34-150200.5.31.1
tomcat10-webapps - update to 10.1.34-150200.5.31.1
tomcat10-admin-webapps - update to 10.1.34-150200.5.31.1
tomcat10-docs-webapp - update to 10.1.34-150200.5.31.1
tomcat10 - update to 10.1.34-150200.5.31.1
tomcat10-embed - update to 10.1.34-150200.5.31.1
tomcat10-lib - update to 10.1.34-150200.5.31.1
tomcat10-jsvc - update to 10.1.34-150200.5.31.1
tomcat10-servlet-6_0-api - update to 10.1.34-150200.5.31.1
IBM Security SOAR - update to 51.0.4.1

• Exploit #10982 - CVE-2024-52317 (December 13, 2024)

• https://tomcat.apache.org/security-9.html
• https://tomcat.apache.org/security-10.html
• https://tomcat.apache.org/security-11.html

• Multiple vulnerabilities in Apache Tomcat
• Multiple vulnerabilities in cPanel EasyApache
• Multiple vulnerabilities in IBM QRadar SIEM
• IBM Integration Bus for z/OS update for Apache Tomcat
• SUSE update for tomcat10
• Multiple vulnerabilities in IBM Security SOAR
• SUSE update for tomcat
• Multiple vulnerabilities in IBM Watson Discovery for IBM Cloud Pak for Data
• IBM Power Hardware Management Console (HMC) update for Apache Tomcat
• Denial of service in Traffix SDC Apache Tomcat component
• Multiple vulnerabilities in IBM watsonx.data
• Multiple vulnerabilities in IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component
• Dell VxRail Appliance 8.x update for third-party components
• Multiple vulnerabilities in IBM Process Mining
• Dell APEX Cloud Platform for Red Hat OpenShift update for third-party components
• Dell APEX Cloud Platform for Microsoft Azure update for third-party components
• Multiple vulnerabilities in IBM Storage Copy Data Management
• Multiple vulnerabilities in IBM Cloud Pak for Security and IBM QRadar Suite Software
• Multiple vulnerabilities in IBM DevOps Release
• Multiple vulnerabilities in IBM Rational Build Forge
• Multiple vulnerabilities in IBM Business Automation Manager Open Editions
• Ubuntu update for tomcat10
• Dell NetWorker update for Apache Tomcat
• Multiple vulnerabilities in IBM webMethods developer portal
• Multiple vulnerabilities in Cloudera Observability on Premises with IBM
• Multiple vulnerabilities in IBM Storage Protect Plus Server
• Multiple vulnerabilities in IBM Cloudera Data Platform Private Cloud Base with IBM (CDP)
• Multiple vulnerabilities in B&R Industrial Automation APROL
• Multiple vulnerabilities in IBM CICS Transaction Gateway for Multiplatforms
• Multiple vulnerabilities in CICS Transaction Gateway Desktop Edition