Resource exhaustion in Apache Tomcat - CVE-2024-23672

Vulnerability identifier: #VU87509

CSH Severity: Medium

CVSS v4 BT: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2024-23672

CWE-ID: CWE-400

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources. A remote attacker can keep WebSocket connections open for a long time to trigger resource exhaustion and perform a denial of service (DoS) attack.

Apache Tomcat
Confluence Server
JBoss Web Server
Amazon Linux AMI
Debian Linux
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing 15
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Anolis OS
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux Server - AUS
Web and Scripting Module
openSUSE Leap
Ubuntu
openEuler
Fedora
Oracle Solaris
Confluence Data Center
IBM UrbanCode Release
IBM Rational Build Forge
Oracle Communications Diameter Signaling Router
Jira Software Data Center
Security Event Manager (SEM)
IBM Watson Discovery for IBM Cloud Pak for Data
Dell Secure Connect Gateway
IBM Power Hardware Management Console (HMC)
EMC NetWorker Server
DevOps
IBM Business Automation Manager Open Editions
CICS Transaction Gateway Desktop Edition
Oracle Communications Policy Management
Cloud Pak for Network Automation
PowerProtect DP Series Appliance (IDPA)
Storage Resource Manager
Storage Virtualize
Maximo Application Suite - Monitor Component
Integration Bus for z/OS
Storage Protect Plus Server
NetWorker Management Console (NMC)
CloudBoost Virtual Appliance
Jira Software Server
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
Tomcat
jws5 (Red Hat package)
jws6 (Red Hat package)
tomcat10 (Ubuntu package)
tomcat8
tomcat-servlet-4_0-api
tomcat-admin-webapps
tomcat-lib
tomcat-jsp-2_3-api
tomcat-el-3_0-api
tomcat
tomcat-docs-webapp
tomcat-javadoc
tomcat-webapps
tomcat9 (Debian package)
tomcat-servlet-4.0-api
tomcat-el-3.0-api
tomcat-jsp-2.3-api
tomcat9
tomcat (Red Hat package)
jws5-tomcat (Red Hat package)
tomcat-jsvc
tomcat-help
tomcat10 (Debian package)
jws6-tomcat (Red Hat package)
tomcat10
tomcat10-servlet-6_0-api
tomcat10-embed
tomcat10-jsvc
tomcat10-jsp-3_1-api
tomcat10-docs-webapp
tomcat10-el-5_0-api
tomcat10-webapps
tomcat10-lib
tomcat10-admin-webapps
Web Help Desk
QRadar Suite
Dell EMC Storage Monitoring and Reporting (SMR)
IBM App Connect Professional
Dell EMC VxRail Appliance
IBM Security Guardium

Install updates from vendor's website.

Apache Tomcat - addressed in versions 8.5.99, 9.0.86, 10.1.19, 11.0.0-M17
Confluence Data Center - addressed in versions 7.19.22, 8.5.9, 8.9.1
Confluence Server - addressed in versions 7.19.22, 8.5.9, 8.9.1
JBoss Web Server - addressed in versions 5.8.0, 6.0.2
IBM UrbanCode Release - update to 7.0.0.1
DevOps - update to 7.0.0.1
IBM Rational Build Forge - update to 8.0.0.26
IBM Business Automation Manager Open Editions - update to 8.0.7
Jira Software Data Center - addressed in versions 9.4.19, 9.12.6, 9.15.2
Jira Software Server - addressed in versions 9.4.19, 9.12.6, 9.15.2
Web Help Desk - update to 12.8.2
Security Event Manager (SEM) - update to 2024.2
Tomcat - update to D.9.0.87.01
jws5 (Red Hat package) - addressed in versions mod_cluster-1.4.5-1.Final_redhat_00001.1.el7jws, mod_cluster-1.4.5-1.Final_redhat_00001.1.el8jws, mod_cluster-1.4.5-1.Final_redhat_00001.1.el9jws
jws6 (Red Hat package) - addressed in versions mod_cluster-2.0.4-1.Final_redhat_00001.1.el8jws, mod_cluster-2.0.4-1.Final_redhat_00001.1.el9jws
QRadar Suite - update to 1.10.22.0
Cloud Pak for Network Automation - update to 2.7.5
PowerProtect DP Series Appliance (IDPA) - update to 2.7.7
IBM Watson Discovery for IBM Cloud Pak for Data - update to 4.8.5
Dell EMC Storage Monitoring and Reporting (SMR) - update to 5.0.1.0
Storage Resource Manager - update to 5.0.1.0
Dell Secure Connect Gateway - update to 5.24.00.14
IBM App Connect Professional - update to 7.5.5.0.24
Dell EMC VxRail Appliance - update to 8.0.212
Storage Virtualize - addressed in versions 8.4.0.14, 8.5.0.12, 8.6.0.4, 8.7.0.0
tomcat10 (Ubuntu package) - addressed in versions 8.5.39-1ubuntu1~18.04.3+esm5, 9.0.16-3ubuntu0.18.04.2+esm7, 9.0.31-1ubuntu0.9+esm2, 9.0.58-1ubuntu0.2+esm3, 9.0.70-2ubuntu0.1+esm2, 9.0.70-2ubuntu1.24.10.2, 9.0.70-2ubuntu1.25.04.2, 10.1.16-1ubuntu0.1~esm2
tomcat8 - update to 8.5.99-1.97
Maximo Application Suite - Monitor Component - addressed in versions 8.10.9, 8.11.6
tomcat-servlet-4_0-api - update to 9.0.36-3.124.1
tomcat-admin-webapps - update to 9.0.36-3.124.1
tomcat-lib - update to 9.0.36-3.124.1
tomcat-jsp-2_3-api - update to 9.0.36-3.124.1
tomcat-el-3_0-api - update to 9.0.36-3.124.1
tomcat - update to 9.0.36-3.124.1
tomcat-docs-webapp - update to 9.0.36-3.124.1
tomcat-javadoc - update to 9.0.36-3.124.1
tomcat-webapps - update to 9.0.36-3.124.1
tomcat9 (Debian package) - update to 9.0.43-2~deb11u10
tomcat - addressed in versions 9.0.86-1, 9.0.87-1
tomcat-webapps - addressed in versions 9.0.86-1, 9.0.87-1
tomcat-servlet-4.0-api - addressed in versions 9.0.86-1, 9.0.87-1
tomcat-lib - addressed in versions 9.0.86-1, 9.0.87-1
tomcat-admin-webapps - addressed in versions 9.0.86-1, 9.0.87-1
tomcat-docs-webapp - addressed in versions 9.0.86-1, 9.0.87-1
tomcat-el-3.0-api - addressed in versions 9.0.86-1, 9.0.87-1
tomcat-jsp-2.3-api - addressed in versions 9.0.86-1, 9.0.87-1
tomcat9 - update to 9.0.87-1
tomcat (Red Hat package) - addressed in versions 9.0.87-1.el8_8.2, 9.0.87-1.el8_10.1, 9.0.87-1.el9_2.1, 9.0.87-1.el9_4.1
jws5-tomcat (Red Hat package) - addressed in versions 9.0.87-3.redhat_00003.1.el7jws, 9.0.87-3.redhat_00003.1.el8jws, 9.0.87-3.redhat_00003.1.el9jws
tomcat - addressed in versions 9.0.89-1.fc39, 9.0.89-1.fc40
tomcat - addressed in versions 9.0.96-1, 9.0.96-2
tomcat-jsvc - addressed in versions 9.0.96-1, 9.0.96-2
tomcat-help - addressed in versions 9.0.96-1, 9.0.96-2
Integration Bus for z/OS - update to 10.1.0.3
tomcat10 (Debian package) - update to 10.1.6-1+deb12u2
jws6-tomcat (Red Hat package) - addressed in versions 10.1.8-7.redhat_00014.1.el8jws, 10.1.8-7.redhat_00014.1.el9jws
Storage Protect Plus Server - update to 10.1.18
tomcat10 - update to 10.1.20-150200.5.22.2
tomcat10-servlet-6_0-api - update to 10.1.20-150200.5.22.2
tomcat10-embed - update to 10.1.20-150200.5.22.2
tomcat10-jsvc - update to 10.1.20-150200.5.22.2
tomcat10-jsp-3_1-api - update to 10.1.20-150200.5.22.2
tomcat10-docs-webapp - update to 10.1.20-150200.5.22.2
tomcat10-el-5_0-api - update to 10.1.20-150200.5.22.2
tomcat10-webapps - update to 10.1.20-150200.5.22.2
tomcat10-lib - update to 10.1.20-150200.5.22.2
tomcat10-admin-webapps - update to 10.1.20-150200.5.22.2
IBM Power Hardware Management Console (HMC) - addressed in versions 10.1.1020.0 SP3, 10.2.1040.0 SP2, 10.3.1050.0 SP1
Oracle Solaris - addressed in versions 11.3 ESU 36.33, 11.4 SRU 68
IBM Security Guardium - update to 12.0 p6009
EMC NetWorker Server - update to 19.10.0.5
NetWorker Management Console (NMC) - update to 19.10.0.5
CloudBoost Virtual Appliance - update to 19.12.0.1

• https://lists.apache.org/thread/cmpswfx6tj4s7x0nxxosvfqs11lvdx2f

• Multiple vulnerabilities in Apache Tomcat
• Multiple vulnerabilities in IBM UrbanCode Release
• Multiple vulnerabilities in IBM DevOps
• Multiple vulnerabilities in IBM Rational Build Forge
• Multiple vulnerabilities in IBM Integration Bus for z/OS
• SUSE update for tomcat10
• SUSE update for tomcat
• Oracle Solaris update for thrid-party components
• SolarWinds Security Event Manager (SEM) update for third-party components
• SolarWinds Web Help Desk update for third-party components
• Resource exhaustion in IBM Power Hardware Management Console (HMC)
• Resource exhaustion in IBM Watson Discovery for IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM Maximo Application Suite - Monitor Component
• Multiple vulnerabilities in App connect professional
• Confluence Data Center and Server update for tomcat-websocket
• Jira Software Data Center and Server update for tomcat-websocket
• Fedora 39 update for tomcat
• Fedora 40 update for tomcat
• Red Hat Enterprise Linux 9 update for tomcat
• Red Hat Enterprise Linux 9.2 Extended Update Support update for tomcat
• Red Hat Enterprise Linux 8 update for tomcat
• Red Hat Enterprise Linux 8.8 Extended Update Support update for tomcat
• Denial of service in Red Hat JBoss Web Server 6.0
• Denial of service in Red Hat JBoss Web Server 5
• Multiple vulnerabilities in Dell Secure Connect Gateway
• Multiple vulnerabilities in Dell EMC VxRail Appliance
• Amazon Linux AMI update for tomcat8
• Multiple vulnerabilities in IBM SAN Volume Controller, IBM Storwize, IBM Storage Virtualize and IBM FlashSystem products
• Debian update for tomcat10
• Debian update for tomcat9
• Multiple vulnerabilities in Oracle Communications Diameter Signaling Router
• Multiple vulnerabilities in IBM QRadar Suite Software
• Multiple vulnerabilities in Dell Storage Resource Manager (SRM) and Dell Storage Monitoring and Reporting (SMR)
• Amazon Linux AMI update for tomcat9
• Multiple vulnerabilities in IBM Security Guardium
• Multiple vulnerabilities in IBM Cloud Pak for Network Automation
• HP-UX update for Tomcat
• Resource exhaustion in Oracle Communications Policy Management
• Multiple vulnerabilities in Dell NetWorker And NetWorker Management Console
• openEuler 22.03 LTS SP4 update for tomcat
• openEuler 22.03 LTS SP1 update for tomcat
• openEuler 20.03 LTS SP4 update for tomcat
• openEuler 22.03 LTS SP3 update for tomcat
• openEuler 24.03 LTS update for tomcat
• Multiple vulnerabilities in Dell PowerProtect DP Series Appliance (IDPA)
• Anolis OS update for tomcat
• Anolis OS update for tomcat
• Multiple vulnerabilities in IBM Business Automation Manager Open Editions
• Dell CloudBoost Virtual Appliance update for third-party components
• Ubuntu update for tomcat10
• Multiple vulnerabilities in IBM Storage Protect Plus Server
• Multiple vulnerabilities in CICS Transaction Gateway Desktop Edition